diff --git a/include/sudo_debug.h b/include/sudo_debug.h
index ea4191b49..b42294e26 100644
--- a/include/sudo_debug.h
+++ b/include/sudo_debug.h
@@ -105,17 +105,17 @@ struct sudo_conf_debug_file_list;
 #ifdef HAVE___FUNC__
 # define debug_decl_func(funcname)
 # define debug_decl_vars(funcname, subsys)				       \
-    const int sudo_debug_subsys = (subsys);
+    const int sudo_debug_subsys = (subsys)
 #else
 # define debug_decl_func(funcname)					       \
     const char __func__[] = #funcname;
 # define debug_decl_vars(funcname, subsys)				       \
-    const int sudo_debug_subsys = (subsys);				       \
-    debug_decl_func(funcname);
+    debug_decl_func(funcname)						       \
+    const int sudo_debug_subsys = (subsys)
 #endif
 #define debug_decl(funcname, subsys)					       \
-    debug_decl_vars((funcname), (subsys))				       \
-    sudo_debug_enter(__func__, __FILE__, __LINE__, sudo_debug_subsys);
+    debug_decl_vars((funcname), (subsys));				       \
+    sudo_debug_enter(__func__, __FILE__, __LINE__, sudo_debug_subsys)
 
 /*
  * Wrappers for sudo_debug_exit() and friends.
diff --git a/lib/iolog/iolog_fileio.c b/lib/iolog/iolog_fileio.c
index 2d1dfdb3c..c7d2b9365 100644
--- a/lib/iolog/iolog_fileio.c
+++ b/lib/iolog/iolog_fileio.c
@@ -76,7 +76,7 @@ io_swapids(bool restore)
 #ifdef HAVE_SETEUID
     static uid_t user_euid = (uid_t)-1;
     static gid_t user_egid = (gid_t)-1;
-    debug_decl(io_swapids, SUDO_DEBUG_UTIL)
+    debug_decl(io_swapids, SUDO_DEBUG_UTIL);
 
     if (user_euid == (uid_t)-1)
 	user_euid = geteuid();
@@ -129,7 +129,7 @@ iolog_mkdirs(char *path)
     struct stat sb;
     int dfd;
     bool ok = false, uid_changed = false;
-    debug_decl(iolog_mkdirs, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_mkdirs, SUDO_DEBUG_UTIL);
 
     if ((dfd = open(path, O_RDONLY|O_NONBLOCK)) != -1)
 	ok = true;
@@ -220,7 +220,7 @@ bool
 iolog_mkdtemp(char *path)
 {
     bool ok, uid_changed = false;
-    debug_decl(iolog_mkdtemp, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_mkdtemp, SUDO_DEBUG_UTIL);
 
     ok = sudo_mkdir_parents(path, iolog_uid, iolog_gid, iolog_dirmode, true);
     if (!ok && errno == EACCES) {
@@ -261,7 +261,7 @@ bool
 iolog_rename(const char *from, const char *to)
 {
     bool ok, uid_changed = false;
-    debug_decl(iolog_rename, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_rename, SUDO_DEBUG_UTIL);
 
     ok = rename(from, to) == 0;
     if (!ok && errno == EACCES) {
@@ -299,7 +299,7 @@ iolog_set_defaults(void)
 void
 iolog_set_maxseq(unsigned int newval)
 {
-    debug_decl(iolog_set_maxseq, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_maxseq, SUDO_DEBUG_UTIL);
 
     /* Clamp to SESSID_MAX as documented. */
     if (newval > SESSID_MAX)
@@ -315,7 +315,7 @@ iolog_set_maxseq(unsigned int newval)
 void
 iolog_set_owner(uid_t uid, gid_t gid)
 {
-    debug_decl(iolog_set_owner, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_owner, SUDO_DEBUG_UTIL);
 
     iolog_uid = uid;
     if (!iolog_gid_set)
@@ -330,7 +330,7 @@ iolog_set_owner(uid_t uid, gid_t gid)
 void
 iolog_set_gid(gid_t gid)
 {
-    debug_decl(iolog_set_gid, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_gid, SUDO_DEBUG_UTIL);
 
     iolog_gid = gid;
     iolog_gid_set = true;
@@ -344,7 +344,7 @@ iolog_set_gid(gid_t gid)
 void
 iolog_set_mode(mode_t mode)
 {
-    debug_decl(iolog_set_mode, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_mode, SUDO_DEBUG_UTIL);
 
     /* I/O log files must be readable and writable by owner. */
     iolog_filemode = S_IRUSR|S_IWUSR;
@@ -368,7 +368,7 @@ iolog_set_mode(mode_t mode)
 void
 iolog_set_compress(bool newval)
 {
-    debug_decl(iolog_set_compress, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_compress, SUDO_DEBUG_UTIL);
     iolog_compress = newval;
     debug_return;
 }
@@ -379,7 +379,7 @@ iolog_set_compress(bool newval)
 void
 iolog_set_flush(bool newval)
 {
-    debug_decl(iolog_set_flush, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_set_flush, SUDO_DEBUG_UTIL);
     iolog_flush = newval;
     debug_return;
 }
@@ -393,7 +393,7 @@ iolog_openat(int dfd, const char *path, int flags)
 {
     int fd;
     mode_t omask = S_IRWXG|S_IRWXO;
-    debug_decl(iolog_openat, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_openat, SUDO_DEBUG_UTIL);
 
     if (ISSET(flags, O_CREAT)) {
 	/* umask must not be more restrictive than the file modes. */
@@ -433,7 +433,7 @@ iolog_nextid(char *iolog_dir, char sessid[7])
     bool ret = false;
     char pathbuf[PATH_MAX];
     static const char b36char[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-    debug_decl(iolog_nextid, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_nextid, SUDO_DEBUG_UTIL);
 
     /*
      * Create I/O log directory if it doesn't already exist.
@@ -525,7 +525,7 @@ iolog_mkpath(char *path)
 {
     size_t len;
     bool ret;
-    debug_decl(iolog_mkpath, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_mkpath, SUDO_DEBUG_UTIL);
 
     /*
      * Create path and intermediate subdirs as needed.
@@ -553,7 +553,7 @@ iolog_open(struct iolog_file *iol, int dfd, int iofd, const char *mode)
     int flags;
     const char *file;
     unsigned char magic[2];
-    debug_decl(iolog_open, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_open, SUDO_DEBUG_UTIL);
 
     if (mode[0] == 'r') {
 	flags = mode[1] == '+' ? O_RDWR : O_RDONLY;
@@ -634,7 +634,7 @@ bool
 iolog_close(struct iolog_file *iol, const char **errstr)
 {
     bool ret = true;
-    debug_decl(iolog_close, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_close, SUDO_DEBUG_UTIL);
 
 #ifdef HAVE_ZLIB_H
     if (iol->compressed) {
@@ -661,7 +661,7 @@ off_t
 iolog_seek(struct iolog_file *iol, off_t offset, int whence)
 {
     off_t ret;
-    //debug_decl(iolog_seek, SUDO_DEBUG_UTIL)
+    //debug_decl(iolog_seek, SUDO_DEBUG_UTIL);
 
 #ifdef HAVE_ZLIB_H
     if (iol->compressed)
@@ -684,7 +684,7 @@ iolog_seek(struct iolog_file *iol, off_t offset, int whence)
 void
 iolog_rewind(struct iolog_file *iol)
 {
-    debug_decl(iolog_rewind, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_rewind, SUDO_DEBUG_UTIL);
 
 #ifdef HAVE_ZLIB_H
     if (iol->compressed)
@@ -704,7 +704,7 @@ iolog_read(struct iolog_file *iol, void *buf, size_t nbytes,
     const char **errstr)
 {
     ssize_t nread;
-    debug_decl(iolog_read, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_read, SUDO_DEBUG_UTIL);
 
     if (nbytes > UINT_MAX) {
 	errno = EINVAL;
@@ -740,7 +740,7 @@ iolog_write(struct iolog_file *iol, const void *buf, size_t len,
     const char **errstr)
 {
     ssize_t ret;
-    debug_decl(iolog_write, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_write, SUDO_DEBUG_UTIL);
 
     if (len > UINT_MAX) {
 	errno = EINVAL;
@@ -797,7 +797,7 @@ bool
 iolog_eof(struct iolog_file *iol)
 {
     bool ret;
-    debug_decl(iolog_eof, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_eof, SUDO_DEBUG_UTIL);
 
 #ifdef HAVE_ZLIB_H
     if (iol->compressed)
@@ -816,7 +816,7 @@ iolog_gets(struct iolog_file *iol, char *buf, size_t nbytes,
     const char **errstr)
 {
     char *str;
-    debug_decl(iolog_gets, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_gets, SUDO_DEBUG_UTIL);
 
     if (nbytes > UINT_MAX) {
 	errno = EINVAL;
@@ -853,7 +853,7 @@ iolog_write_info_file(int dfd, const char *parent, struct iolog_info *log_info,
     char * const *av;
     FILE *fp;
     int error, fd;
-    debug_decl(iolog_info_write_log, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_info_write_log, SUDO_DEBUG_UTIL);
 
     fd = iolog_openat(dfd, "log", O_CREAT|O_TRUNC|O_WRONLY);
     if (fd == -1 || (fp = fdopen(fd, "w")) == NULL) {
@@ -900,7 +900,7 @@ const char *
 iolog_fd_to_name(int iofd)
 {
     const char *ret;
-    debug_decl(iolog_fd_to_name, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_fd_to_name, SUDO_DEBUG_UTIL);
 
     switch (iofd) {
     case IOFD_STDIN:
diff --git a/lib/iolog/iolog_path.c b/lib/iolog/iolog_path.c
index 5373e6197..e571646de 100644
--- a/lib/iolog/iolog_path.c
+++ b/lib/iolog/iolog_path.c
@@ -62,7 +62,7 @@ expand_iolog_path(const char *inpath, char *path, size_t pathlen,
     const char *endbrace, *src;
     bool strfit = false;
     size_t len;
-    debug_decl(expand_iolog_path, SUDO_DEBUG_UTIL)
+    debug_decl(expand_iolog_path, SUDO_DEBUG_UTIL);
 
     /* Collapse multiple leading slashes. */
     while (inpath[0] == '/' && inpath[1] == '/')
diff --git a/lib/iolog/iolog_util.c b/lib/iolog/iolog_util.c
index daa37736c..c16cb0d3a 100644
--- a/lib/iolog/iolog_util.c
+++ b/lib/iolog/iolog_util.c
@@ -67,7 +67,7 @@ iolog_parse_loginfo(FILE *fp, const char *logfile)
     const char *errstr;
     size_t bufsize = 0, cwdsize = 0, cmdsize = 0;
     struct iolog_info *li = NULL;
-    debug_decl(iolog_parse_loginfo, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_parse_loginfo, SUDO_DEBUG_UTIL);
 
     /*
      * Info file has three lines:
@@ -181,7 +181,7 @@ iolog_adjust_delay(struct timespec *delay, struct timespec *max_delay,
      double scale_factor)
 {
     double seconds;
-    debug_decl(iolog_adjust_delay, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_adjust_delay, SUDO_DEBUG_UTIL);
 
     if (scale_factor != 1.0) {
 	/* Order is important: we don't want to double the remainder. */
@@ -219,7 +219,7 @@ iolog_parse_delay(const char *cp, struct timespec *delay,
     const char *errstr, *ep;
     long long llval;
     size_t len;
-    debug_decl(iolog_parse_delay, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_parse_delay, SUDO_DEBUG_UTIL);
 
     /* Parse seconds (whole number portion). */
     for (ep = cp; isdigit((unsigned char)*ep); ep++)
@@ -300,7 +300,7 @@ iolog_parse_timing(const char *line, struct timing_closure *timing)
 {
     unsigned long ulval;
     char *cp, *ep;
-    debug_decl(iolog_parse_timing, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_parse_timing, SUDO_DEBUG_UTIL);
 
     /* Clear iolog descriptor. */
     timing->iol = NULL;
@@ -372,7 +372,7 @@ iolog_read_timing_record(struct iolog_file *iol, struct timing_closure *timing)
 {
     char line[LINE_MAX];
     const char *errstr;
-    debug_decl(iolog_read_timing_record, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_read_timing_record, SUDO_DEBUG_UTIL);
 
     /* Read next record from timing file. */
     if (iolog_gets(iol, line, sizeof(line), &errstr) == NULL) {
diff --git a/lib/util/aix.c b/lib/util/aix.c
index b5aa6b648..cfc793b32 100644
--- a/lib/util/aix.c
+++ b/lib/util/aix.c
@@ -73,7 +73,7 @@ static struct aix_limit aix_limits[] = {
 static int
 aix_getlimit(char *user, char *lim, int *valp)
 {
-    debug_decl(aix_getlimit, SUDO_DEBUG_UTIL)
+    debug_decl(aix_getlimit, SUDO_DEBUG_UTIL);
 
     if (getuserattr(user, lim, valp, SEC_INT) != 0)
 	debug_return_int(-1);
@@ -86,7 +86,7 @@ aix_setlimits(char *user)
     struct rlimit64 rlim;
     int val;
     size_t n;
-    debug_decl(aix_setlimits, SUDO_DEBUG_UTIL)
+    debug_decl(aix_setlimits, SUDO_DEBUG_UTIL);
 
     if (setuserdb(S_READ) != 0) {
 	sudo_warn(U_("unable to open userdb"));
@@ -162,7 +162,7 @@ aix_getauthregistry_v1(char *user, char *saved_registry)
 {
     int serrno = errno;
     int ret = -1;
-    debug_decl(aix_getauthregistry, SUDO_DEBUG_UTIL)
+    debug_decl(aix_getauthregistry, SUDO_DEBUG_UTIL);
 
     saved_registry[0] = '\0';
     if (user != NULL) {
@@ -213,7 +213,7 @@ aix_setauthdb_v2(char *user, char *registry)
     authdb_t regbuf;
     int serrno = errno;
     int ret = -1;
-    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL)
+    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL);
 
     if (user != NULL) {
 	/* Look up authentication registry if one is not provided. */
@@ -246,7 +246,7 @@ aix_restoreauthdb_v1(void)
 {
     int serrno = errno;
     int ret = 0;
-    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL)
+    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL);
 
     if (setauthdb(old_registry, NULL) != 0) {
 	sudo_warn(U_("unable to restore registry"));
@@ -266,7 +266,7 @@ aix_prep_user_v1(char *user, const char *tty)
 {
     char *info;
     int len;
-    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL)
+    debug_decl(aix_setauthdb, SUDO_DEBUG_UTIL);
 
     /* set usrinfo, like login(1) does */
     len = asprintf(&info, "NAME=%s%cLOGIN=%s%cLOGNAME=%s%cTTY=%s%c",
diff --git a/lib/util/digest.c b/lib/util/digest.c
index 8c6b75693..6a9ccf658 100644
--- a/lib/util/digest.c
+++ b/lib/util/digest.c
@@ -96,7 +96,7 @@ struct sudo_digest {
 struct sudo_digest *
 sudo_digest_alloc_v1(int digest_type)
 {
-    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL);
     struct digest_function *func = NULL;
     struct sudo_digest *dig;
     int i;
@@ -123,7 +123,7 @@ sudo_digest_alloc_v1(int digest_type)
 void
 sudo_digest_free_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL);
 
     free(dig);
 
@@ -133,7 +133,7 @@ sudo_digest_free_v1(struct sudo_digest *dig)
 void
 sudo_digest_reset_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL);
 
     dig->func->init(&dig->ctx);
 
@@ -143,7 +143,7 @@ sudo_digest_reset_v1(struct sudo_digest *dig)
 int
 sudo_digest_getlen_v1(int digest_type)
 {
-    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL);
     int i;
 
     for (i = 0; digest_functions[i].digest_len != 0; i++) {
@@ -157,7 +157,7 @@ sudo_digest_getlen_v1(int digest_type)
 void
 sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 {
-    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL);
 
     dig->func->update(&dig->ctx, data, len);
 
@@ -167,7 +167,7 @@ sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 void
 sudo_digest_final_v1(struct sudo_digest *dig, unsigned char *md)
 {
-    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL);
 
     dig->func->final(md, &dig->ctx);
 
diff --git a/lib/util/digest_gcrypt.c b/lib/util/digest_gcrypt.c
index 8d5c75d45..2c06721de 100644
--- a/lib/util/digest_gcrypt.c
+++ b/lib/util/digest_gcrypt.c
@@ -70,7 +70,7 @@ sudo_digest_type_to_gcry(int digest_type)
 struct sudo_digest *
 sudo_digest_alloc_v1(int digest_type)
 {
-    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL);
     struct sudo_digest *dig;
     int gcry_digest_type;
 
@@ -96,7 +96,7 @@ sudo_digest_alloc_v1(int digest_type)
 void
 sudo_digest_free_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL);
 
     if (dig != NULL) {
 	gcry_md_close(dig->ctx);
@@ -109,7 +109,7 @@ sudo_digest_free_v1(struct sudo_digest *dig)
 void
 sudo_digest_reset_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL);
 
     gcry_md_reset(dig->ctx);
 
@@ -119,7 +119,7 @@ sudo_digest_reset_v1(struct sudo_digest *dig)
 int
 sudo_digest_getlen_v1(int digest_type)
 {
-    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL);
     int gcry_digest_type;
 
     gcry_digest_type = sudo_digest_type_to_gcry(digest_type);
@@ -132,7 +132,7 @@ sudo_digest_getlen_v1(int digest_type)
 void
 sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 {
-    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL);
 
     gcry_md_write(dig->ctx, data, len);
 
@@ -142,7 +142,7 @@ sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 void
 sudo_digest_final_v1(struct sudo_digest *dig, unsigned char *md)
 {
-    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL);
 
     gcry_md_final(dig->ctx);
     memcpy(md, gcry_md_read(dig->ctx, 0), dig->digest_len);
diff --git a/lib/util/digest_openssl.c b/lib/util/digest_openssl.c
index 4224ad0cd..0663d37b3 100644
--- a/lib/util/digest_openssl.c
+++ b/lib/util/digest_openssl.c
@@ -87,7 +87,7 @@ struct sudo_digest {
 struct sudo_digest *
 sudo_digest_alloc_v1(int digest_type)
 {
-    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_alloc, SUDO_DEBUG_UTIL);
     struct digest_function *func = NULL;
     struct sudo_digest *dig;
     int i;
@@ -114,7 +114,7 @@ sudo_digest_alloc_v1(int digest_type)
 void
 sudo_digest_free_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_free, SUDO_DEBUG_UTIL);
 
     free(dig);
 
@@ -124,7 +124,7 @@ sudo_digest_free_v1(struct sudo_digest *dig)
 void
 sudo_digest_reset_v1(struct sudo_digest *dig)
 {
-    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_reset, SUDO_DEBUG_UTIL);
 
     dig->func->init(&dig->ctx);
 
@@ -133,7 +133,7 @@ sudo_digest_reset_v1(struct sudo_digest *dig)
 int
 sudo_digest_getlen_v1(int digest_type)
 {
-    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_getlen, SUDO_DEBUG_UTIL);
     int i;
 
     for (i = 0; digest_functions[i].digest_len != 0; i++) {
@@ -147,7 +147,7 @@ sudo_digest_getlen_v1(int digest_type)
 void
 sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 {
-    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_update, SUDO_DEBUG_UTIL);
 
     dig->func->update(&dig->ctx, data, len);
 
@@ -157,7 +157,7 @@ sudo_digest_update_v1(struct sudo_digest *dig, const void *data, size_t len)
 void
 sudo_digest_final_v1(struct sudo_digest *dig, unsigned char *md)
 {
-    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_digest_final, SUDO_DEBUG_UTIL);
 
     dig->func->final(md, &dig->ctx);
 
diff --git a/lib/util/event.c b/lib/util/event.c
index b66748b7e..03aa04972 100644
--- a/lib/util/event.c
+++ b/lib/util/event.c
@@ -86,7 +86,7 @@ static void
 sudo_ev_deactivate_all(struct sudo_event_base *base)
 {
     struct sudo_event *ev;
-    debug_decl(sudo_ev_deactivate_all, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_deactivate_all, SUDO_DEBUG_EVENT);
 
     while ((ev = TAILQ_FIRST(&base->active)) != NULL)
 	sudo_ev_deactivate(base, ev);
@@ -104,7 +104,7 @@ sudo_ev_activate_sigevents(struct sudo_event_base *base)
     struct sudo_event *ev;
     sigset_t set, oset;
     int i;
-    debug_decl(sudo_ev_activate_sigevents, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_activate_sigevents, SUDO_DEBUG_EVENT);
 
     /*
      * We treat this as a critical section since the signal handler
@@ -148,7 +148,7 @@ signal_pipe_cb(int fd, int what, void *v)
     struct sudo_event_base *base = v;
     unsigned char ch;
     ssize_t nread;
-    debug_decl(signal_pipe_cb, SUDO_DEBUG_EVENT)
+    debug_decl(signal_pipe_cb, SUDO_DEBUG_EVENT);
 
     /*
      * Drain signal_pipe, the signal handler updated base->signals_pending.
@@ -174,7 +174,7 @@ static int
 sudo_ev_base_init(struct sudo_event_base *base)
 {
     int i;
-    debug_decl(sudo_ev_base_init, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_init, SUDO_DEBUG_EVENT);
 
     TAILQ_INIT(&base->events);
     TAILQ_INIT(&base->timeouts);
@@ -204,7 +204,7 @@ struct sudo_event_base *
 sudo_ev_base_alloc_v1(void)
 {
     struct sudo_event_base *base;
-    debug_decl(sudo_ev_base_alloc, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_alloc, SUDO_DEBUG_EVENT);
 
     base = calloc(1, sizeof(*base));
     if (base == NULL) {
@@ -224,7 +224,7 @@ sudo_ev_base_free_v1(struct sudo_event_base *base)
 {
     struct sudo_event *ev, *next;
     int i;
-    debug_decl(sudo_ev_base_free, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_free, SUDO_DEBUG_EVENT);
 
     if (base == NULL)
 	debug_return;
@@ -257,7 +257,7 @@ sudo_ev_base_free_v1(struct sudo_event_base *base)
 void
 sudo_ev_base_setdef_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_base_setdef, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_setdef, SUDO_DEBUG_EVENT);
 
     default_base = base;
 
@@ -271,7 +271,7 @@ static void
 sudo_ev_init(struct sudo_event *ev, int fd, short events,
     sudo_ev_callback_t callback, void *closure)
 {
-    debug_decl(sudo_ev_init, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_init, SUDO_DEBUG_EVENT);
 
     /* XXX - sanity check events value */
     memset(ev, 0, sizeof(*ev));
@@ -292,7 +292,7 @@ int
 sudo_ev_set_v1(struct sudo_event *ev, int fd, short events,
     sudo_ev_callback_t callback, void *closure)
 {
-    debug_decl(sudo_ev_set, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_set, SUDO_DEBUG_EVENT);
 
     /* For SUDO_EV_SIGINFO we use a container to store closure + siginfo_t */
     if (ISSET(events, SUDO_EV_SIGINFO)) {
@@ -315,7 +315,7 @@ struct sudo_event *
 sudo_ev_alloc_v1(int fd, short events, sudo_ev_callback_t callback, void *closure)
 {
     struct sudo_event *ev;
-    debug_decl(sudo_ev_alloc, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_alloc, SUDO_DEBUG_EVENT);
 
     ev = malloc(sizeof(*ev));
     if (ev == NULL) {
@@ -333,7 +333,7 @@ sudo_ev_alloc_v1(int fd, short events, sudo_ev_callback_t callback, void *closur
 void
 sudo_ev_free_v1(struct sudo_event *ev)
 {
-    debug_decl(sudo_ev_free, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_free, SUDO_DEBUG_EVENT);
 
     if (ev == NULL)
 	debug_return;
@@ -376,7 +376,7 @@ sudo_ev_add_signal(struct sudo_event_base *base, struct sudo_event *ev,
     bool tohead)
 {
     const int signo = ev->fd;
-    debug_decl(sudo_ev_add_signal, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_add_signal, SUDO_DEBUG_EVENT);
 
     sudo_debug_printf(SUDO_DEBUG_INFO,
 	"%s: adding event %p to base %p, signal %d, events %d",
@@ -471,7 +471,7 @@ int
 sudo_ev_add_v2(struct sudo_event_base *base, struct sudo_event *ev,
     struct timespec *timo, bool tohead)
 {
-    debug_decl(sudo_ev_add, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_add, SUDO_DEBUG_EVENT);
 
     /* If no base specified, use existing or default base. */
     if (base == NULL) {
@@ -547,7 +547,7 @@ sudo_ev_add_v2(struct sudo_event_base *base, struct sudo_event *ev,
 int
 sudo_ev_del_v1(struct sudo_event_base *base, struct sudo_event *ev)
 {
-    debug_decl(sudo_ev_del, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_del, SUDO_DEBUG_EVENT);
 
     /* Make sure event is really in the queue. */
     if (!ISSET(ev->flags, SUDO_EVQ_INSERTED)) {
@@ -638,7 +638,7 @@ sudo_ev_loop_v1(struct sudo_event_base *base, int flags)
     struct timespec now;
     struct sudo_event *ev;
     int nready, rc = 0;
-    debug_decl(sudo_ev_loop, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_loop, SUDO_DEBUG_EVENT);
 
     /*
      * If sudo_ev_loopexit() was called when events were not running
@@ -742,7 +742,7 @@ done:
 void
 sudo_ev_loopexit_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_loopexit, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_loopexit, SUDO_DEBUG_EVENT);
 
     if (base == NULL) {
 	if ((base = default_base) == NULL)
@@ -761,7 +761,7 @@ sudo_ev_loopexit_v1(struct sudo_event_base *base)
 void
 sudo_ev_loopbreak_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_loopbreak, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_loopbreak, SUDO_DEBUG_EVENT);
 
     if (base == NULL) {
 	if ((base = default_base) == NULL)
@@ -777,7 +777,7 @@ sudo_ev_loopbreak_v1(struct sudo_event_base *base)
 void
 sudo_ev_loopcontinue_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_loopcontinue, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_loopcontinue, SUDO_DEBUG_EVENT);
 
     if (base == NULL) {
 	if ((base = default_base) == NULL)
@@ -794,7 +794,7 @@ sudo_ev_loopcontinue_v1(struct sudo_event_base *base)
 bool
 sudo_ev_got_exit_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_got_exit, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_got_exit, SUDO_DEBUG_EVENT);
 
     if (base == NULL) {
 	if ((base = default_base) == NULL)
@@ -806,7 +806,7 @@ sudo_ev_got_exit_v1(struct sudo_event_base *base)
 bool
 sudo_ev_got_break_v1(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_got_break, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_got_break, SUDO_DEBUG_EVENT);
 
     if (base == NULL) {
 	if ((base = default_base) == NULL)
@@ -830,7 +830,7 @@ sudo_ev_get_timeleft_v1(struct sudo_event *ev, struct timeval *tv)
 int
 sudo_ev_get_timeleft_v2(struct sudo_event *ev, struct timespec *ts)
 {
-    debug_decl(sudo_ev_get_timeleft, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_get_timeleft, SUDO_DEBUG_EVENT);
 
     if (sudo_ev_pending_v1(ev, SUDO_EV_TIMEOUT, ts) != SUDO_EV_TIMEOUT) {
 	sudo_timespecclear(ts);
@@ -843,7 +843,7 @@ int
 sudo_ev_pending_v1(struct sudo_event *ev, short events, struct timespec *ts)
 {
     int ret = 0;
-    debug_decl(sudo_ev_pending, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_pending, SUDO_DEBUG_EVENT);
 
     if (!ISSET(ev->flags, SUDO_EVQ_INSERTED))
 	debug_return_int(0);
diff --git a/lib/util/event_poll.c b/lib/util/event_poll.c
index 5f45ec601..820734452 100644
--- a/lib/util/event_poll.c
+++ b/lib/util/event_poll.c
@@ -52,7 +52,7 @@ int
 sudo_ev_base_alloc_impl(struct sudo_event_base *base)
 {
     int i;
-    debug_decl(sudo_ev_base_alloc_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_alloc_impl, SUDO_DEBUG_EVENT);
 
     base->pfd_high = -1;
     base->pfd_max = 32;
@@ -73,7 +73,7 @@ sudo_ev_base_alloc_impl(struct sudo_event_base *base)
 void
 sudo_ev_base_free_impl(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_base_free_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_free_impl, SUDO_DEBUG_EVENT);
     free(base->pfds);
     debug_return;
 }
@@ -82,7 +82,7 @@ int
 sudo_ev_add_impl(struct sudo_event_base *base, struct sudo_event *ev)
 {
     struct pollfd *pfd;
-    debug_decl(sudo_ev_add_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_add_impl, SUDO_DEBUG_EVENT);
 
     /* If out of space in pfds array, realloc. */
     if (base->pfd_free == base->pfd_max) {
@@ -129,7 +129,7 @@ sudo_ev_add_impl(struct sudo_event_base *base, struct sudo_event *ev)
 int
 sudo_ev_del_impl(struct sudo_event_base *base, struct sudo_event *ev)
 {
-    debug_decl(sudo_ev_del_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_del_impl, SUDO_DEBUG_EVENT);
 
     /* Mark pfd entry unused, add to free list and adjust high slot. */
     base->pfds[ev->pfd_idx].fd = -1;
@@ -164,7 +164,7 @@ sudo_ev_scan_impl(struct sudo_event_base *base, int flags)
     struct timespec now, ts, *timeout;
     struct sudo_event *ev;
     int nready;
-    debug_decl(sudo_ev_scan_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_scan_impl, SUDO_DEBUG_EVENT);
 
     if ((ev = TAILQ_FIRST(&base->timeouts)) != NULL) {
 	sudo_gettime_mono(&now);
diff --git a/lib/util/event_select.c b/lib/util/event_select.c
index 3273b3e0e..8096df152 100644
--- a/lib/util/event_select.c
+++ b/lib/util/event_select.c
@@ -57,7 +57,7 @@
 int
 sudo_ev_base_alloc_impl(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_base_alloc_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_alloc_impl, SUDO_DEBUG_EVENT);
 
     base->maxfd = NFDBITS - 1;
     base->readfds_in = calloc(1, sizeof(fd_mask));
@@ -78,7 +78,7 @@ sudo_ev_base_alloc_impl(struct sudo_event_base *base)
 void
 sudo_ev_base_free_impl(struct sudo_event_base *base)
 {
-    debug_decl(sudo_ev_base_free_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_base_free_impl, SUDO_DEBUG_EVENT);
     free(base->readfds_in);
     free(base->writefds_in);
     free(base->readfds_out);
@@ -89,7 +89,7 @@ sudo_ev_base_free_impl(struct sudo_event_base *base)
 int
 sudo_ev_add_impl(struct sudo_event_base *base, struct sudo_event *ev)
 {
-    debug_decl(sudo_ev_add_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_add_impl, SUDO_DEBUG_EVENT);
 
     /* If out of space in fd sets, realloc. */
     if (ev->fd > base->maxfd) {
@@ -149,7 +149,7 @@ sudo_ev_add_impl(struct sudo_event_base *base, struct sudo_event *ev)
 int
 sudo_ev_del_impl(struct sudo_event_base *base, struct sudo_event *ev)
 {
-    debug_decl(sudo_ev_del_impl, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_del_impl, SUDO_DEBUG_EVENT);
 
     /* Remove from readfds and writefds and adjust high fd. */
     if (ISSET(ev->events, SUDO_EV_READ)) {
@@ -204,7 +204,7 @@ sudo_ev_scan_impl(struct sudo_event_base *base, int flags)
     struct sudo_event *ev;
     size_t setsize;
     int nready;
-    debug_decl(sudo_ev_loop, SUDO_DEBUG_EVENT)
+    debug_decl(sudo_ev_loop, SUDO_DEBUG_EVENT);
 
     if ((ev = TAILQ_FIRST(&base->timeouts)) != NULL) {
 	sudo_gettime_mono(&now);
diff --git a/lib/util/gettime.c b/lib/util/gettime.c
index aadb72846..f25805892 100644
--- a/lib/util/gettime.c
+++ b/lib/util/gettime.c
@@ -68,7 +68,7 @@
 int
 sudo_gettime_real_v1(struct timespec *ts)
 {
-    debug_decl(sudo_gettime_real, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_real, SUDO_DEBUG_UTIL);
 
     if (clock_gettime(CLOCK_REALTIME, ts) == -1) {
 	struct timeval tv;
@@ -86,7 +86,7 @@ int
 sudo_gettime_real_v1(struct timespec *ts)
 {
     struct timeval tv;
-    debug_decl(sudo_gettime_real, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_real, SUDO_DEBUG_UTIL);
 
     if (gettimeofday(&tv, NULL) == -1)
 	debug_return_int(-1);
@@ -104,7 +104,7 @@ int
 sudo_gettime_mono_v1(struct timespec *ts)
 {
     static int has_monoclock = -1;
-    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL);
 
     /* Check whether the kernel/libc actually supports a monotonic clock. */
 # ifdef _SC_MONOTONIC_CLOCK
@@ -127,7 +127,7 @@ int
 sudo_gettime_mono_v1(struct timespec *ts)
 {
     hrtime_t nsec;
-    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL);
 
     nsec = gethrtime();
     ts->tv_sec = nsec / 1000000000;
@@ -140,7 +140,7 @@ sudo_gettime_mono_v1(struct timespec *ts)
 {
     uint64_t abstime, nsec;
     static mach_timebase_info_data_t timebase_info;
-    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_mono, SUDO_DEBUG_UTIL);
 
     if (timebase_info.denom == 0)
 	(void) mach_timebase_info(&timebase_info);
@@ -172,7 +172,7 @@ int
 sudo_gettime_awake_v1(struct timespec *ts)
 {
     static int has_monoclock = -1;
-    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL);
 
     /* Check whether the kernel/libc actually supports a monotonic clock. */
 # ifdef _SC_MONOTONIC_CLOCK
@@ -195,7 +195,7 @@ int
 sudo_gettime_awake_v1(struct timespec *ts)
 {
     hrtime_t nsec;
-    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL);
 
     /* Currently the same as sudo_gettime_mono() */
     nsec = gethrtime();
@@ -209,7 +209,7 @@ sudo_gettime_awake_v1(struct timespec *ts)
 {
     uint64_t abstime, nsec;
     static mach_timebase_info_data_t timebase_info;
-    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_gettime_awake, SUDO_DEBUG_UTIL);
 
     if (timebase_info.denom == 0)
 	(void) mach_timebase_info(&timebase_info);
diff --git a/lib/util/getusershell.c b/lib/util/getusershell.c
index 6aeae3b6b..2dbe82f24 100644
--- a/lib/util/getusershell.c
+++ b/lib/util/getusershell.c
@@ -58,7 +58,7 @@ read_shells(void)
     size_t linesize = 0;
     char *line = NULL;
     FILE *fp;
-    debug_decl(read_shells, SUDO_DEBUG_UTIL)
+    debug_decl(read_shells, SUDO_DEBUG_UTIL);
 
     if ((fp = fopen("/etc/shells", "r")) == NULL)
 	goto bad;
@@ -101,7 +101,7 @@ bad:
 void
 sudo_setusershell(void)
 {
-    debug_decl(setusershell, SUDO_DEBUG_UTIL)
+    debug_decl(setusershell, SUDO_DEBUG_UTIL);
 
     current_shell = read_shells();
 
@@ -111,7 +111,7 @@ sudo_setusershell(void)
 void
 sudo_endusershell(void)
 {
-    debug_decl(endusershell, SUDO_DEBUG_UTIL)
+    debug_decl(endusershell, SUDO_DEBUG_UTIL);
 
     if (allowed_shells != NULL) {
 	char **shell;
@@ -129,7 +129,7 @@ sudo_endusershell(void)
 char *
 sudo_getusershell(void)
 {
-    debug_decl(getusershell, SUDO_DEBUG_UTIL)
+    debug_decl(getusershell, SUDO_DEBUG_UTIL);
 
     if (current_shell == NULL)
 	current_shell = read_shells();
diff --git a/lib/util/gidlist.c b/lib/util/gidlist.c
index 8d08abd02..fa29d7795 100644
--- a/lib/util/gidlist.c
+++ b/lib/util/gidlist.c
@@ -51,7 +51,7 @@ sudo_parse_gids_v1(const char *gidstr, const gid_t *basegid, GETGROUPS_T **gidsp
     const char *cp = gidstr;
     const char *errstr;
     char *ep;
-    debug_decl(sudo_parse_gids, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_parse_gids, SUDO_DEBUG_UTIL);
 
     /* Count groups. */
     if (*cp != '\0') {
diff --git a/lib/util/host_port.c b/lib/util/host_port.c
index 9a112d47f..31a03ee0c 100644
--- a/lib/util/host_port.c
+++ b/lib/util/host_port.c
@@ -42,7 +42,7 @@ sudo_parse_host_port_v1(char *str, char **hostp, char **portp, char *defport)
 {
     char *port, *host = str;
     bool ret = false;
-    debug_decl(sudo_parse_host_port, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_parse_host_port, SUDO_DEBUG_UTIL);
 
     /* Check for IPv6 address like [::0] followed by optional port */
     if (*host == '[') {
diff --git a/lib/util/key_val.c b/lib/util/key_val.c
index e50e42181..5b5eb52d5 100644
--- a/lib/util/key_val.c
+++ b/lib/util/key_val.c
@@ -48,7 +48,7 @@ sudo_new_key_val_v1(const char *key, const char *val)
     size_t key_len = strlen(key);
     size_t val_len = strlen(val);
     char *cp, *str;
-    debug_decl(sudo_new_key_val, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_new_key_val, SUDO_DEBUG_UTIL);
 
     cp = str = malloc(key_len + 1 + val_len + 1);
     if (cp != NULL) {
diff --git a/lib/util/lbuf.c b/lib/util/lbuf.c
index 1c95c7cac..9eaefd7c9 100644
--- a/lib/util/lbuf.c
+++ b/lib/util/lbuf.c
@@ -43,7 +43,7 @@ void
 sudo_lbuf_init_v1(struct sudo_lbuf *lbuf, sudo_lbuf_output_t output,
     int indent, const char *continuation, int cols)
 {
-    debug_decl(sudo_lbuf_init, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_init, SUDO_DEBUG_UTIL);
 
     lbuf->output = output;
     lbuf->continuation = continuation;
@@ -60,7 +60,7 @@ sudo_lbuf_init_v1(struct sudo_lbuf *lbuf, sudo_lbuf_output_t output,
 void
 sudo_lbuf_destroy_v1(struct sudo_lbuf *lbuf)
 {
-    debug_decl(sudo_lbuf_destroy, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_destroy, SUDO_DEBUG_UTIL);
 
     free(lbuf->buf);
     lbuf->buf = NULL;
@@ -71,7 +71,7 @@ sudo_lbuf_destroy_v1(struct sudo_lbuf *lbuf)
 static bool
 sudo_lbuf_expand(struct sudo_lbuf *lbuf, int extra)
 {
-    debug_decl(sudo_lbuf_expand, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_expand, SUDO_DEBUG_UTIL);
 
     if (lbuf->len + extra + 1 >= lbuf->size) {
 	char *new_buf;
@@ -103,7 +103,7 @@ sudo_lbuf_append_quoted_v1(struct sudo_lbuf *lbuf, const char *set, const char *
     bool ret = false;
     char *cp, *s;
     va_list ap;
-    debug_decl(sudo_lbuf_append_quoted, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_append_quoted, SUDO_DEBUG_UTIL);
 
     if (sudo_lbuf_error(lbuf))
 	debug_return_bool(false);
@@ -161,7 +161,7 @@ sudo_lbuf_append_v1(struct sudo_lbuf *lbuf, const char *fmt, ...)
     bool ret = false;
     va_list ap;
     char *s;
-    debug_decl(sudo_lbuf_append, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_append, SUDO_DEBUG_UTIL);
 
     if (sudo_lbuf_error(lbuf))
 	debug_return_bool(false);
@@ -203,7 +203,7 @@ sudo_lbuf_println(struct sudo_lbuf *lbuf, char *line, int len)
     int i, have, contlen = 0;
     int indent = lbuf->indent;
     bool is_comment = false;
-    debug_decl(sudo_lbuf_println, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_println, SUDO_DEBUG_UTIL);
 
     /* Comment lines don't use continuation and only indent is for "# " */
     if (line[0] == '#' && isblank((unsigned char)line[1])) {
@@ -276,7 +276,7 @@ sudo_lbuf_print_v1(struct sudo_lbuf *lbuf)
 {
     char *cp, *ep;
     int len;
-    debug_decl(sudo_lbuf_print, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lbuf_print, SUDO_DEBUG_UTIL);
 
     if (lbuf->buf == NULL || lbuf->len == 0)
 	goto done;
diff --git a/lib/util/locking.c b/lib/util/locking.c
index e739c13de..51f9bdf6f 100644
--- a/lib/util/locking.c
+++ b/lib/util/locking.c
@@ -64,7 +64,7 @@ bool
 sudo_lock_region_v1(int fd, int type, off_t len)
 {
     int op;
-    debug_decl(sudo_lock_region, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lock_region, SUDO_DEBUG_UTIL);
 
     switch (type) {
 	case SUDO_LOCK:
@@ -94,7 +94,7 @@ sudo_lock_region_v1(int fd, int type, off_t len)
 {
     struct flock lock;
     int func;
-    debug_decl(sudo_lock_file, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_lock_file, SUDO_DEBUG_UTIL);
 
     switch (type) {
 	case SUDO_LOCK:
diff --git a/lib/util/logfac.c b/lib/util/logfac.c
index afce291fd..616fb07f8 100644
--- a/lib/util/logfac.c
+++ b/lib/util/logfac.c
@@ -68,7 +68,7 @@ bool
 sudo_str2logfac_v1(const char *str, int *logfac)
 {
     const struct strmap *fac;
-    debug_decl(sudo_str2logfac, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_str2logfac, SUDO_DEBUG_UTIL);
 
     for (fac = facilities; fac->name != NULL; fac++) {
 	if (strcmp(str, fac->name) == 0) {
@@ -83,7 +83,7 @@ const char *
 sudo_logfac2str_v1(int num)
 {
     const struct strmap *fac;
-    debug_decl(sudo_logfac2str, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_logfac2str, SUDO_DEBUG_UTIL);
 
     for (fac = facilities; fac->name != NULL; fac++) {
 	if (fac->num == num)
diff --git a/lib/util/logpri.c b/lib/util/logpri.c
index 1b28c8745..7e2ab0c0c 100644
--- a/lib/util/logpri.c
+++ b/lib/util/logpri.c
@@ -63,7 +63,7 @@ bool
 sudo_str2logpri_v1(const char *str, int *logpri)
 {
     const struct strmap *pri;
-    debug_decl(sudo_str2logpri, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_str2logpri, SUDO_DEBUG_UTIL);
 
     for (pri = priorities; pri->name != NULL; pri++) {
 	if (strcmp(str, pri->name) == 0) {
@@ -78,7 +78,7 @@ const char *
 sudo_logpri2str_v1(int num)
 {
     const struct strmap *pri;
-    debug_decl(sudo_logpri2str, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_logpri2str, SUDO_DEBUG_UTIL);
 
     for (pri = priorities; pri->name != NULL; pri++) {
 	if (pri->num == num)
diff --git a/lib/util/mkdir_parents.c b/lib/util/mkdir_parents.c
index 39d725a51..4ec898746 100644
--- a/lib/util/mkdir_parents.c
+++ b/lib/util/mkdir_parents.c
@@ -60,7 +60,7 @@ bool
 sudo_mkdir_parents_v1(char *path, uid_t uid, gid_t gid, mode_t mode, bool quiet)
 {
     char *slash = path;
-    debug_decl(sudo_mkdir_parents, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_mkdir_parents, SUDO_DEBUG_UTIL);
 
     /* cppcheck-suppress nullPointerRedundantCheck */
     while ((slash = strchr(slash + 1, '/')) != NULL) {
diff --git a/lib/util/parseln.c b/lib/util/parseln.c
index e48b4fbf4..fbf6243fe 100644
--- a/lib/util/parseln.c
+++ b/lib/util/parseln.c
@@ -58,7 +58,7 @@ sudo_parseln_v2(char **bufp, size_t *bufsizep, unsigned int *lineno, FILE *fp, i
     ssize_t len;
     char *cp, *line = NULL;
     bool continued, comment;
-    debug_decl(sudo_parseln, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_parseln, SUDO_DEBUG_UTIL);
 
     do {
 	comment = false;
diff --git a/lib/util/secure_path.c b/lib/util/secure_path.c
index 4ca8bbcb6..581432017 100644
--- a/lib/util/secure_path.c
+++ b/lib/util/secure_path.c
@@ -47,7 +47,7 @@ sudo_secure_path(const char *path, unsigned int type, uid_t uid, gid_t gid, stru
 {
     struct stat sb;
     int ret = SUDO_PATH_MISSING;
-    debug_decl(sudo_secure_path, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_secure_path, SUDO_DEBUG_UTIL);
 
     if (path != NULL && stat(path, &sb) == 0) {
 	if ((sb.st_mode & _S_IFMT) != type) {
diff --git a/lib/util/setgroups.c b/lib/util/setgroups.c
index 3e34be04c..dac41a29d 100644
--- a/lib/util/setgroups.c
+++ b/lib/util/setgroups.c
@@ -39,7 +39,7 @@ int
 sudo_setgroups_v1(int ngids, const GETGROUPS_T *gids)
 {
     int maxgids, ret;
-    debug_decl(sudo_setgroups, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_setgroups, SUDO_DEBUG_UTIL);
 
     ret = setgroups(ngids, (GETGROUPS_T *)gids);
     if (ret == -1 && errno == EINVAL) {
diff --git a/lib/util/strsplit.c b/lib/util/strsplit.c
index c7ef74d7e..9a6491ef8 100644
--- a/lib/util/strsplit.c
+++ b/lib/util/strsplit.c
@@ -42,7 +42,7 @@ const char *
 sudo_strsplit_v1(const char *str, const char *endstr, const char *sep, const char **last)
 {
     const char *cp, *s;
-    debug_decl(sudo_strsplit, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_strsplit, SUDO_DEBUG_UTIL);
 
     /* If no str specified, use last ptr (if any). */
     if (str == NULL)
diff --git a/lib/util/strtobool.c b/lib/util/strtobool.c
index 41c0b45e2..095d9f629 100644
--- a/lib/util/strtobool.c
+++ b/lib/util/strtobool.c
@@ -41,7 +41,7 @@
 int
 sudo_strtobool_v1(const char *str)
 {
-    debug_decl(sudo_strtobool, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_strtobool, SUDO_DEBUG_UTIL);
 
     switch (*str) {
 	case '0':
diff --git a/lib/util/strtoid.c b/lib/util/strtoid.c
index 1312aa6a4..781fb7fe9 100644
--- a/lib/util/strtoid.c
+++ b/lib/util/strtoid.c
@@ -84,7 +84,7 @@ sudo_strtoidx_v1(const char *p, const char *sep, char **endp, const char **errst
     const char *errstr;
     char *ep;
     id_t ret;
-    debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL);
 
     ret = sudo_strtonumx(p, INT_MIN, UINT_MAX, &ep, &errstr);
     if (errstr == NULL) {
diff --git a/lib/util/strtomode.c b/lib/util/strtomode.c
index a4a3ebffd..136a36eec 100644
--- a/lib/util/strtomode.c
+++ b/lib/util/strtomode.c
@@ -47,7 +47,7 @@ sudo_strtomode_v1(const char *cp, const char **errstr)
 {
     char *ep;
     long lval;
-    debug_decl(sudo_strtomode, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_strtomode, SUDO_DEBUG_UTIL);
 
     errno = 0;
     lval = strtol(cp, &ep, 8);
diff --git a/lib/util/sudo_conf.c b/lib/util/sudo_conf.c
index a8fca8776..e3bf7eaf6 100644
--- a/lib/util/sudo_conf.c
+++ b/lib/util/sudo_conf.c
@@ -139,7 +139,7 @@ parse_variable(const char *entry, const char *conf_file, unsigned int lineno)
 {
     struct sudo_conf_table *var;
     int ret;
-    debug_decl(parse_variable, SUDO_DEBUG_UTIL)
+    debug_decl(parse_variable, SUDO_DEBUG_UTIL);
 
     for (var = sudo_conf_var_table; var->name != NULL; var++) {
 	if (strncmp(entry, var->name, var->namelen) == 0 &&
@@ -170,7 +170,7 @@ parse_path(const char *entry, const char *conf_file, unsigned int lineno)
     const char *ep, *name, *path;
     struct sudo_conf_path_table *cur;
     size_t namelen;
-    debug_decl(parse_path, SUDO_DEBUG_UTIL)
+    debug_decl(parse_path, SUDO_DEBUG_UTIL);
 
     /* Parse name. */
     name = sudo_strsplit(entry, entry_end, " \t", &ep);
@@ -223,7 +223,7 @@ parse_debug(const char *entry, const char *conf_file, unsigned int lineno)
     const char *ep, *path, *progname, *flags;
     const char *entry_end = entry + strlen(entry);
     size_t pathlen, prognamelen;
-    debug_decl(parse_debug, SUDO_DEBUG_UTIL)
+    debug_decl(parse_debug, SUDO_DEBUG_UTIL);
 
     /* Parse progname. */
     progname = sudo_strsplit(entry, entry_end, " \t", &ep);
@@ -295,7 +295,7 @@ parse_plugin(const char *entry, const char *conf_file, unsigned int lineno)
     char **options = NULL;
     size_t pathlen, symlen;
     unsigned int nopts = 0;
-    debug_decl(parse_plugin, SUDO_DEBUG_UTIL)
+    debug_decl(parse_plugin, SUDO_DEBUG_UTIL);
 
     /* Parse symbol. */
     symbol = sudo_strsplit(entry, entry_end, " \t", &ep);
@@ -370,7 +370,7 @@ set_var_developer_mode(const char *strval, const char *conf_file,
     unsigned int lineno)
 {
     int val = sudo_strtobool(strval);
-    debug_decl(set_var_developer_mode, SUDO_DEBUG_UTIL)
+    debug_decl(set_var_developer_mode, SUDO_DEBUG_UTIL);
 
     if (val == -1) {
         sudo_warnx(U_("invalid value for %s \"%s\" in %s, line %u"),
@@ -386,7 +386,7 @@ set_var_disable_coredump(const char *strval, const char *conf_file,
     unsigned int lineno)
 {
     int val = sudo_strtobool(strval);
-    debug_decl(set_var_disable_coredump, SUDO_DEBUG_UTIL)
+    debug_decl(set_var_disable_coredump, SUDO_DEBUG_UTIL);
 
     if (val == -1) {
 	sudo_warnx(U_("invalid value for %s \"%s\" in %s, line %u"),
@@ -401,7 +401,7 @@ static int
 set_var_group_source(const char *strval, const char *conf_file,
     unsigned int lineno)
 {
-    debug_decl(set_var_group_source, SUDO_DEBUG_UTIL)
+    debug_decl(set_var_group_source, SUDO_DEBUG_UTIL);
 
     if (strcasecmp(strval, "adaptive") == 0) {
 	sudo_conf_data.group_source = GROUP_SOURCE_ADAPTIVE;
@@ -422,7 +422,7 @@ set_var_max_groups(const char *strval, const char *conf_file,
     unsigned int lineno)
 {
     int max_groups;
-    debug_decl(set_var_max_groups, SUDO_DEBUG_UTIL)
+    debug_decl(set_var_max_groups, SUDO_DEBUG_UTIL);
 
     max_groups = sudo_strtonum(strval, 1, INT_MAX, NULL);
     if (max_groups <= 0) {
@@ -439,7 +439,7 @@ set_var_probe_interfaces(const char *strval, const char *conf_file,
     unsigned int lineno)
 {
     int val = sudo_strtobool(strval);
-    debug_decl(set_var_probe_interfaces, SUDO_DEBUG_UTIL)
+    debug_decl(set_var_probe_interfaces, SUDO_DEBUG_UTIL);
 
     if (val == -1) {
 	sudo_warnx(U_("invalid value for %s \"%s\" in %s, line %u"),
@@ -511,7 +511,7 @@ sudo_conf_debug_files_v1(const char *progname)
     struct sudo_conf_debug *debug_spec;
     size_t prognamelen, progbaselen;
     const char *progbase = progname;
-    debug_decl(sudo_conf_debug_files, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_conf_debug_files, SUDO_DEBUG_UTIL);
 
     /* Determine basename if program is fully qualified (like for plugins). */
     prognamelen = progbaselen = strlen(progname);
@@ -570,7 +570,7 @@ sudo_conf_read_v1(const char *conf_file, int conf_types)
     char *prev_locale, *line = NULL;
     unsigned int conf_lineno = 0;
     size_t linesize = 0;
-    debug_decl(sudo_conf_read, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_conf_read, SUDO_DEBUG_UTIL);
 
     if ((prev_locale = setlocale(LC_ALL, NULL)) == NULL) {
 	sudo_warn("setlocale(LC_ALL, NULL)");
@@ -669,7 +669,7 @@ void
 sudo_conf_clear_paths_v1(void)
 {
     struct sudo_conf_path_table *cur;
-    debug_decl(sudo_conf_clear_paths, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_conf_clear_paths, SUDO_DEBUG_UTIL);
 
     for (cur = sudo_conf_data.path_table; cur->pname != NULL; cur++) {
 	if (cur->dynamic)
diff --git a/lib/util/term.c b/lib/util/term.c
index dac965840..7fe3333de 100644
--- a/lib/util/term.c
+++ b/lib/util/term.c
@@ -147,7 +147,7 @@ tcsetattr_nobg(int fd, int flags, struct termios *tp)
 bool
 sudo_term_restore_v1(int fd, bool flush)
 {
-    debug_decl(sudo_term_restore, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_term_restore, SUDO_DEBUG_UTIL);
 
     if (changed) {
 	const int flags = flush ? (TCSASOFT|TCSAFLUSH) : (TCSASOFT|TCSADRAIN);
@@ -165,7 +165,7 @@ sudo_term_restore_v1(int fd, bool flush)
 bool
 sudo_term_noecho_v1(int fd)
 {
-    debug_decl(sudo_term_noecho, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_term_noecho, SUDO_DEBUG_UTIL);
 
     if (!changed && tcgetattr(fd, &oterm) != 0)
 	debug_return_bool(false);
@@ -189,7 +189,7 @@ bool
 sudo_term_raw_v1(int fd, int isig)
 {
     struct termios term;
-    debug_decl(sudo_term_raw, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_term_raw, SUDO_DEBUG_UTIL);
 
     if (!changed && tcgetattr(fd, &oterm) != 0)
 	debug_return_bool(false);
@@ -212,7 +212,7 @@ sudo_term_raw_v1(int fd, int isig)
 bool
 sudo_term_cbreak_v1(int fd)
 {
-    debug_decl(sudo_term_cbreak, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_term_cbreak, SUDO_DEBUG_UTIL);
 
     if (!changed && tcgetattr(fd, &oterm) != 0)
 	debug_return_bool(false);
@@ -256,7 +256,7 @@ sudo_term_copy_v1(int src, int dst)
     struct winsize wsize;
     speed_t speed;
     int i;
-    debug_decl(sudo_term_copy, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_term_copy, SUDO_DEBUG_UTIL);
 
     if (tcgetattr(src, &tt_src) != 0 || tcgetattr(dst, &tt_dst) != 0)
 	debug_return_bool(false);
diff --git a/lib/util/ttyname_dev.c b/lib/util/ttyname_dev.c
index fdb5b2973..410a73b1b 100644
--- a/lib/util/ttyname_dev.c
+++ b/lib/util/ttyname_dev.c
@@ -62,7 +62,7 @@ char *
 sudo_ttyname_dev_v1(dev_t tdev, char *name, size_t namelen)
 {
     char *dev;
-    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL);
 
     /* Some versions of devname() return NULL on failure, others do not. */
     dev = devname(tdev, S_IFCHR);
@@ -89,7 +89,7 @@ char *
 sudo_ttyname_dev_v1(dev_t tdev, char *name, size_t namelen)
 {
     int serrno = errno;
-    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL);
 
     /*
      * _ttyname_dev() sets errno to ERANGE if namelen is too small
@@ -128,7 +128,7 @@ sudo_ttyname_scan(const char *dir, dev_t rdev, char *name, size_t namelen)
     struct stat sb;
     unsigned int i;
     DIR *d = NULL;
-    debug_decl(sudo_ttyname_scan, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_ttyname_scan, SUDO_DEBUG_UTIL);
 
     if (dir[0] == '\0') {
 	errno = ENOENT;
@@ -233,7 +233,7 @@ static char *
 sudo_dev_check(dev_t rdev, const char *devname, char *buf, size_t buflen)
 {
     struct stat sb;
-    debug_decl(sudo_dev_check, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_dev_check, SUDO_DEBUG_UTIL);
 
     if (stat(devname, &sb) == 0) {
 	if (S_ISCHR(sb.st_mode) && sb.st_rdev == rdev) {
@@ -265,7 +265,7 @@ sudo_ttyname_dev_v1(dev_t rdev, char *buf, size_t buflen)
     char path[PATH_MAX], *ret;
     const char *cp, *ep;
     size_t len;
-    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_ttyname_dev, SUDO_DEBUG_UTIL);
 
     /*
      * First, check /dev/console.
diff --git a/lib/util/ttysize.c b/lib/util/ttysize.c
index a70793d47..f98a5928a 100644
--- a/lib/util/ttysize.c
+++ b/lib/util/ttysize.c
@@ -39,7 +39,7 @@ static int
 get_ttysize_ioctl(int *rowp, int *colp)
 {
     struct winsize wsize;
-    debug_decl(get_ttysize_ioctl, SUDO_DEBUG_UTIL)
+    debug_decl(get_ttysize_ioctl, SUDO_DEBUG_UTIL);
 
     if (ioctl(STDERR_FILENO, TIOCGWINSZ, &wsize) == 0 &&
 	wsize.ws_row != 0 && wsize.ws_col  != 0) {
@@ -53,7 +53,7 @@ get_ttysize_ioctl(int *rowp, int *colp)
 void
 sudo_get_ttysize_v1(int *rowp, int *colp)
 {
-    debug_decl(sudo_get_ttysize, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_get_ttysize, SUDO_DEBUG_UTIL);
 
     if (get_ttysize_ioctl(rowp, colp) == -1) {
 	char *p;
diff --git a/logsrvd/eventlog.c b/logsrvd/eventlog.c
index 38731741f..599daaf52 100644
--- a/logsrvd/eventlog.c
+++ b/logsrvd/eventlog.c
@@ -85,7 +85,7 @@ new_logline(const char *message, const char *errstr,
     const char *tsid = NULL;
     size_t len = 0;
     int i;
-    debug_decl(new_logline, SUDO_DEBUG_UTIL)
+    debug_decl(new_logline, SUDO_DEBUG_UTIL);
 
     /* A TSID may be a sudoers-style session ID or a free-form string. */
     if (iolog_file != NULL) {
@@ -238,7 +238,7 @@ static void
 mysyslog(int pri, const char *fmt, ...)
 {
     va_list ap;
-    debug_decl(mysyslog, SUDO_DEBUG_UTIL)
+    debug_decl(mysyslog, SUDO_DEBUG_UTIL);
 
     openlog("sudo", 0, logsrvd_conf_syslog_facility());
     va_start(ap, fmt);
@@ -258,7 +258,7 @@ do_syslog(int pri, const struct iolog_details *details, char *msg)
     size_t len, maxlen;
     char *p, *tmp, save;
     const char *fmt;
-    debug_decl(do_syslog, SUDO_DEBUG_UTIL)
+    debug_decl(do_syslog, SUDO_DEBUG_UTIL);
 
     /* A priority of -1 corresponds to "none". */
     if (pri == -1)
@@ -314,7 +314,7 @@ do_logfile(const char *logfile, const struct iolog_details *details,
     bool ret = false;
     mode_t oldmask;
     FILE *fp;
-    debug_decl(do_logfile, SUDO_DEBUG_UTIL)
+    debug_decl(do_logfile, SUDO_DEBUG_UTIL);
 
     oldmask = umask(S_IRWXG|S_IRWXO);
     fp = fopen(logfile, "a");
@@ -361,7 +361,7 @@ log_accept(const struct iolog_details *details)
     char *logline;
     bool ret = true;
     int pri;
-    debug_decl(log_accept, SUDO_DEBUG_UTIL)
+    debug_decl(log_accept, SUDO_DEBUG_UTIL);
 
     if (log_type == EVLOG_NONE)
 	debug_return_bool(true);
@@ -395,7 +395,7 @@ log_reject(const struct iolog_details *details, const char *reason)
     char *logline;
     bool ret = true;
     int pri;
-    debug_decl(log_reject, SUDO_DEBUG_UTIL)
+    debug_decl(log_reject, SUDO_DEBUG_UTIL);
 
     if (log_type == EVLOG_NONE)
 	debug_return_bool(true);
@@ -430,7 +430,7 @@ log_alert(const struct iolog_details *details, TimeSpec *alert_time,
     char *logline;
     bool ret = true;
     int pri;
-    debug_decl(log_alert, SUDO_DEBUG_UTIL)
+    debug_decl(log_alert, SUDO_DEBUG_UTIL);
 
     if (log_type == EVLOG_NONE)
 	debug_return_bool(true);
diff --git a/logsrvd/iolog_writer.c b/logsrvd/iolog_writer.c
index 3fd562690..b11f76b17 100644
--- a/logsrvd/iolog_writer.c
+++ b/logsrvd/iolog_writer.c
@@ -73,7 +73,7 @@ strlist_copy(InfoMessage__StringList *strlist)
 {
     char **dst, **src = strlist->strings;
     size_t i, len = strlist->n_strings;
-    debug_decl(strlist_copy, SUDO_DEBUG_UTIL)
+    debug_decl(strlist_copy, SUDO_DEBUG_UTIL);
 
     dst = reallocarray(NULL, len + 1, sizeof(char *));
     if (dst == NULL) {
@@ -107,7 +107,7 @@ void
 iolog_details_free(struct iolog_details *details)
 {
     int i;
-    debug_decl(iolog_details_free, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_details_free, SUDO_DEBUG_UTIL);
 
     if (details != NULL) {
 	free(details->iolog_path);
@@ -138,7 +138,7 @@ iolog_details_fill(struct iolog_details *details, TimeSpec *submit_time,
 {
     size_t idx;
     bool ret = false;
-    debug_decl(iolog_details_fill, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_details_fill, SUDO_DEBUG_UTIL);
 
     memset(details, 0, sizeof(*details));
 
@@ -383,7 +383,7 @@ fill_seq(char *str, size_t strsize, void *v)
     struct iolog_path_closure *closure = v;
     char *sessid = closure->details->sessid;
     int len;
-    debug_decl(fill_seq, SUDO_DEBUG_UTIL)
+    debug_decl(fill_seq, SUDO_DEBUG_UTIL);
 
     if (sessid[0] == '\0') {
 	if (!iolog_nextid(closure->iolog_dir, sessid))
@@ -406,7 +406,7 @@ fill_user(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_user, SUDO_DEBUG_UTIL)
+    debug_decl(fill_user, SUDO_DEBUG_UTIL);
 
     if (details->submituser == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -421,7 +421,7 @@ fill_group(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_group, SUDO_DEBUG_UTIL)
+    debug_decl(fill_group, SUDO_DEBUG_UTIL);
 
     if (details->submitgroup == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -436,7 +436,7 @@ fill_runas_user(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_runas_user, SUDO_DEBUG_UTIL)
+    debug_decl(fill_runas_user, SUDO_DEBUG_UTIL);
 
     if (details->runuser == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -451,7 +451,7 @@ fill_runas_group(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_runas_group, SUDO_DEBUG_UTIL)
+    debug_decl(fill_runas_group, SUDO_DEBUG_UTIL);
 
     /* FIXME: rungroup not guaranteed to be set */
     if (details->rungroup == NULL) {
@@ -467,7 +467,7 @@ fill_hostname(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_hostname, SUDO_DEBUG_UTIL)
+    debug_decl(fill_hostname, SUDO_DEBUG_UTIL);
 
     if (details->submithost == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -482,7 +482,7 @@ fill_command(char *str, size_t strsize, void *v)
 {
     struct iolog_path_closure *closure = v;
     const struct iolog_details *details = closure->details;
-    debug_decl(fill_command, SUDO_DEBUG_UTIL)
+    debug_decl(fill_command, SUDO_DEBUG_UTIL);
 
     if (details->command == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -515,7 +515,7 @@ create_iolog_path(struct connection_closure *closure)
     struct iolog_path_closure path_closure;
     char expanded_dir[PATH_MAX], expanded_file[PATH_MAX], pathbuf[PATH_MAX];
     size_t len;
-    debug_decl(create_iolog_path, SUDO_DEBUG_UTIL)
+    debug_decl(create_iolog_path, SUDO_DEBUG_UTIL);
 
     path_closure.details = details;
     path_closure.iolog_dir = expanded_dir;
@@ -583,7 +583,7 @@ iolog_details_write(struct iolog_details *details,
      struct connection_closure *closure)
 {
     struct iolog_info log_info;
-    debug_decl(iolog_details_write, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_details_write, SUDO_DEBUG_UTIL);
 
     /* Convert to iolog_info */
     memset(&log_info, 0, sizeof(log_info));
@@ -603,7 +603,7 @@ iolog_details_write(struct iolog_details *details,
 static bool
 iolog_create(int iofd, struct connection_closure *closure)
 {
-    debug_decl(iolog_create, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_create, SUDO_DEBUG_UTIL);
 
     if (iofd < 0 || iofd >= IOFD_MAX) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -621,7 +621,7 @@ iolog_close_all(struct connection_closure *closure)
 {
     const char *errstr;
     int i;
-    debug_decl(iolog_close, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_close, SUDO_DEBUG_UTIL);
 
     for (i = 0; i < IOFD_MAX; i++) {
 	if (!closure->iolog_files[i].enabled)
@@ -640,7 +640,7 @@ iolog_close_all(struct connection_closure *closure)
 bool
 iolog_init(AcceptMessage *msg, struct connection_closure *closure)
 {
-    debug_decl(iolog_init, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_init, SUDO_DEBUG_UTIL);
 
     /* Create I/O log path */
     if (!create_iolog_path(closure))
@@ -673,7 +673,7 @@ iolog_copy(struct iolog_file *src, struct iolog_file *dst, off_t remainder,
 {
     char buf[64 * 1024];
     ssize_t nread;
-    debug_decl(iolog_copy, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_copy, SUDO_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
 	"copying %lld bytes", (long long)remainder);
@@ -706,7 +706,7 @@ iolog_rewrite(const struct timespec *target, struct connection_closure *closure)
     const char *name, *errstr;
     char tmpdir[PATH_MAX];
     bool ret = false;
-    debug_decl(iolog_rewrite, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_rewrite, SUDO_DEBUG_UTIL);
 
     /* Parse timing file until we reach the target point. */
     /* TODO: use iolog_seekto with a callback? */
@@ -853,7 +853,7 @@ iolog_restart(RestartMessage *msg, struct connection_closure *closure)
     struct timespec target;
     struct stat sb;
     int iofd;
-    debug_decl(iolog_restart, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_restart, SUDO_DEBUG_UTIL);
 
     target.tv_sec = msg->resume_point->tv_sec;
     target.tv_nsec = msg->resume_point->tv_nsec;
@@ -924,7 +924,7 @@ bad:
 static void
 update_elapsed_time(TimeSpec *delta, struct timespec *elapsed)
 {
-    debug_decl(update_elapsed_time, SUDO_DEBUG_UTIL)
+    debug_decl(update_elapsed_time, SUDO_DEBUG_UTIL);
 
     /* Cannot use timespecadd since msg doesn't use struct timespec. */
     elapsed->tv_sec += delta->tv_sec;
@@ -943,7 +943,7 @@ store_iobuf(int iofd, IoBuffer *msg, struct connection_closure *closure)
     const char *errstr;
     char tbuf[1024];
     int len;
-    debug_decl(store_iobuf, SUDO_DEBUG_UTIL)
+    debug_decl(store_iobuf, SUDO_DEBUG_UTIL);
 
     /* Open log file as needed. */
     if (!closure->iolog_files[iofd].enabled) {
@@ -991,7 +991,7 @@ store_suspend(CommandSuspend *msg, struct connection_closure *closure)
     const char *errstr;
     char tbuf[1024];
     int len;
-    debug_decl(store_suspend, SUDO_DEBUG_UTIL)
+    debug_decl(store_suspend, SUDO_DEBUG_UTIL);
 
     /* Format timing data including suspend signal. */
     len = snprintf(tbuf, sizeof(tbuf), "%d %lld.%09d %s\n", IO_EVENT_SUSPEND,
@@ -1024,7 +1024,7 @@ store_winsize(ChangeWindowSize *msg, struct connection_closure *closure)
     const char *errstr;
     char tbuf[1024];
     int len;
-    debug_decl(store_winsize, SUDO_DEBUG_UTIL)
+    debug_decl(store_winsize, SUDO_DEBUG_UTIL);
 
     /* Format timing data including new window size. */
     len = snprintf(tbuf, sizeof(tbuf), "%d %lld.%09d %d %d\n", IO_EVENT_WINSIZE,
diff --git a/logsrvd/logsrv_util.c b/logsrvd/logsrv_util.c
index 84ea662fb..e2e32bed4 100644
--- a/logsrvd/logsrv_util.c
+++ b/logsrvd/logsrv_util.c
@@ -50,7 +50,7 @@ bool
 expand_buf(struct connection_buffer *buf, unsigned int needed)
 {
     void *newdata;
-    debug_decl(expand_buf, SUDO_DEBUG_UTIL)
+    debug_decl(expand_buf, SUDO_DEBUG_UTIL);
 
     if (buf->size < needed) {
 	/* Expand buffer. */
@@ -87,7 +87,7 @@ iolog_open_all(int dfd, const char *iolog_dir, struct iolog_file *iolog_files,
     const char *mode)
 {
     int iofd;
-    debug_decl(iolog_open_all, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_open_all, SUDO_DEBUG_UTIL);
 
     for (iofd = 0; iofd < IOFD_MAX; iofd++) {
 	iolog_files[iofd].enabled = true;
@@ -117,7 +117,7 @@ iolog_seekto(int iolog_dir_fd, const char *iolog_path,
 {
     struct timing_closure timing;
     off_t pos;
-    debug_decl(iolog_seekto, SUDO_DEBUG_UTIL)
+    debug_decl(iolog_seekto, SUDO_DEBUG_UTIL);
 
     /* Parse timing file until we reach the target point. */
     for (;;) {
diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c
index cd1170c16..7af1acc31 100644
--- a/logsrvd/logsrvd.c
+++ b/logsrvd/logsrvd.c
@@ -86,7 +86,7 @@ static double random_drop;
 static void
 connection_closure_free(struct connection_closure *closure)
 {
-    debug_decl(connection_closure_free, SUDO_DEBUG_UTIL)
+    debug_decl(connection_closure_free, SUDO_DEBUG_UTIL);
 
     if (closure != NULL) {
 	bool shutting_down = closure->state == SHUTDOWN;
@@ -121,7 +121,7 @@ fmt_server_message(struct connection_buffer *buf, ServerMessage *msg)
     uint32_t msg_len;
     bool ret = false;
     size_t len;
-    debug_decl(fmt_server_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_server_message, SUDO_DEBUG_UTIL);
 
     if (buf->len != 0) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -165,7 +165,7 @@ fmt_hello_message(struct connection_buffer *buf)
 {
     ServerMessage msg = SERVER_MESSAGE__INIT;
     ServerHello hello = SERVER_HELLO__INIT;
-    debug_decl(fmt_hello_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_hello_message, SUDO_DEBUG_UTIL);
 
     /* TODO: implement redirect and servers array.  */
     hello.server_id = (char *)server_id;
@@ -186,7 +186,7 @@ static bool
 fmt_log_id_message(const char *id, struct connection_buffer *buf)
 {
     ServerMessage msg = SERVER_MESSAGE__INIT;
-    debug_decl(fmt_log_id_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_log_id_message, SUDO_DEBUG_UTIL);
 
     msg.log_id = (char *)id;
     msg.type_case = SERVER_MESSAGE__TYPE_LOG_ID;
@@ -198,7 +198,7 @@ static bool
 fmt_error_message(const char *errstr, struct connection_buffer *buf)
 {
     ServerMessage msg = SERVER_MESSAGE__INIT;
-    debug_decl(fmt_error_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_error_message, SUDO_DEBUG_UTIL);
 
     msg.error = (char *)errstr;
     msg.type_case = SERVER_MESSAGE__TYPE_ERROR;
@@ -212,7 +212,7 @@ fmt_error_message(const char *errstr, struct connection_buffer *buf)
 static bool
 handle_accept(AcceptMessage *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_accept, SUDO_DEBUG_UTIL)
+    debug_decl(handle_accept, SUDO_DEBUG_UTIL);
 
     if (closure->state != INITIAL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -279,7 +279,7 @@ handle_accept(AcceptMessage *msg, struct connection_closure *closure)
 static bool
 handle_reject(RejectMessage *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_reject, SUDO_DEBUG_UTIL)
+    debug_decl(handle_reject, SUDO_DEBUG_UTIL);
 
     if (closure->state != INITIAL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -322,7 +322,7 @@ handle_exit(ExitMessage *msg, struct connection_closure *closure)
 {
     struct timespec tv = { 0, 0 };
     mode_t mode;
-    debug_decl(handle_exit, SUDO_DEBUG_UTIL)
+    debug_decl(handle_exit, SUDO_DEBUG_UTIL);
 
     if (closure->state != RUNNING) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -371,7 +371,7 @@ handle_exit(ExitMessage *msg, struct connection_closure *closure)
 static bool
 handle_restart(RestartMessage *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_restart, SUDO_DEBUG_UTIL)
+    debug_decl(handle_restart, SUDO_DEBUG_UTIL);
 
     if (closure->state != INITIAL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -405,7 +405,7 @@ handle_restart(RestartMessage *msg, struct connection_closure *closure)
 static bool
 handle_alert(AlertMessage *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_alert, SUDO_DEBUG_UTIL)
+    debug_decl(handle_alert, SUDO_DEBUG_UTIL);
 
     if (!log_alert(&closure->details, msg->alert_time, msg->reason)) {
 	closure->errstr = _("error logging alert event");
@@ -418,7 +418,7 @@ handle_alert(AlertMessage *msg, struct connection_closure *closure)
 static bool
 handle_iobuf(int iofd, IoBuffer *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_iobuf, SUDO_DEBUG_UTIL)
+    debug_decl(handle_iobuf, SUDO_DEBUG_UTIL);
 
     if (closure->state != RUNNING) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -463,7 +463,7 @@ handle_iobuf(int iofd, IoBuffer *msg, struct connection_closure *closure)
 static bool
 handle_winsize(ChangeWindowSize *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_winsize, SUDO_DEBUG_UTIL)
+    debug_decl(handle_winsize, SUDO_DEBUG_UTIL);
 
     if (closure->state != RUNNING) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -489,7 +489,7 @@ handle_winsize(ChangeWindowSize *msg, struct connection_closure *closure)
 static bool
 handle_suspend(CommandSuspend *msg, struct connection_closure *closure)
 {
-    debug_decl(handle_suspend, SUDO_DEBUG_UTIL)
+    debug_decl(handle_suspend, SUDO_DEBUG_UTIL);
 
     if (closure->state != RUNNING) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -518,7 +518,7 @@ handle_client_message(uint8_t *buf, size_t len,
 {
     ClientMessage *msg;
     bool ret = false;
-    debug_decl(handle_client_message, SUDO_DEBUG_UTIL)
+    debug_decl(handle_client_message, SUDO_DEBUG_UTIL);
 
     msg = client_message__unpack(NULL, len, buf);
     if (msg == NULL) {
@@ -579,7 +579,7 @@ static void
 shutdown_cb(int unused, int what, void *v)
 {
     struct sudo_event_base *base = v;
-    debug_decl(shutdown_cb, SUDO_DEBUG_UTIL)
+    debug_decl(shutdown_cb, SUDO_DEBUG_UTIL);
 
 #if defined(HAVE_OPENSSL)
     /* deallocate server's SSL context object */
@@ -601,7 +601,7 @@ server_shutdown(struct sudo_event_base *base)
     struct connection_closure *closure;
     struct sudo_event *ev;
     struct timespec tv = { 0, 0 };
-    debug_decl(server_shutdown, SUDO_DEBUG_UTIL)
+    debug_decl(server_shutdown, SUDO_DEBUG_UTIL);
 
     if (TAILQ_EMPTY(&connections)) {
 	sudo_ev_loopbreak(base);
@@ -640,7 +640,7 @@ server_msg_cb(int fd, int what, void *v)
     struct connection_closure *closure = v;
     struct connection_buffer *buf = &closure->write_buf;
     ssize_t nwritten;
-    debug_decl(server_msg_cb, SUDO_DEBUG_UTIL)
+    debug_decl(server_msg_cb, SUDO_DEBUG_UTIL);
 
     if (what == SUDO_EV_TIMEOUT) {
         sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -727,7 +727,7 @@ client_msg_cb(int fd, int what, void *v)
     uint32_t msg_len;
     ssize_t nread;
 
-    debug_decl(client_msg_cb, SUDO_DEBUG_UTIL)
+    debug_decl(client_msg_cb, SUDO_DEBUG_UTIL);
 
     if (what == SUDO_EV_TIMEOUT) {
         sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -850,7 +850,7 @@ server_commit_cb(int unused, int what, void *v)
     TimeSpec commit_point = TIME_SPEC__INIT;
     struct connection_closure *closure = v;
 
-    debug_decl(server_commit_cb, SUDO_DEBUG_UTIL)
+    debug_decl(server_commit_cb, SUDO_DEBUG_UTIL);
 
     /* Send the client an acknowledgement of what has been committed to disk. */
     commit_point.tv_sec = closure->elapsed_time.tv_sec;
@@ -887,7 +887,7 @@ static void
 signal_cb(int signo, int what, void *v)
 {
     struct sudo_event_base *base = v;
-    debug_decl(signal_cb, SUDO_DEBUG_UTIL)
+    debug_decl(signal_cb, SUDO_DEBUG_UTIL);
 
     switch (signo) {
 	case SIGHUP:
@@ -917,7 +917,7 @@ verify_server_cert(SSL_CTX *ctx, const struct logsrvd_tls_config *tls_config)
     X509_STORE *ca_store;
     STACK_OF(X509) *chain_certs;
     X509 *x509;
-    debug_decl(verify_server_cert, SUDO_DEBUG_UTIL)
+    debug_decl(verify_server_cert, SUDO_DEBUG_UTIL);
 
     if ((x509 = SSL_CTX_get0_certificate(ctx)) == NULL) {
         sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -967,7 +967,7 @@ exit:
 static bool
 init_tls_ciphersuites(SSL_CTX *ctx, const struct logsrvd_tls_config *tls_config)
 {
-    debug_decl(init_tls_ciphersuites, SUDO_DEBUG_UTIL)
+    debug_decl(init_tls_ciphersuites, SUDO_DEBUG_UTIL);
 
     if (tls_config->ciphers_v12) {
 	/* try to set TLS v1.2 ciphersuite list from config if given */
@@ -1034,7 +1034,7 @@ init_tls_server_context(void)
     const SSL_METHOD *method;
     SSL_CTX *ctx = NULL;
     const struct logsrvd_tls_config *tls_config = logsrvd_get_tls_config();
-    debug_decl(init_tls_server_context, SUDO_DEBUG_UTIL)
+    debug_decl(init_tls_server_context, SUDO_DEBUG_UTIL);
 
     SSL_library_init();
     OpenSSL_add_all_algorithms();
@@ -1161,7 +1161,7 @@ tls_handshake_cb(int fd, int what, void *v)
     struct connection_closure *closure = v;
     struct sudo_event_base *base = closure->ssl_accept_ev->base;
 
-    debug_decl(tls_handshake_cb, SUDO_DEBUG_UTIL)
+    debug_decl(tls_handshake_cb, SUDO_DEBUG_UTIL);
 
     if (what == SUDO_EV_TIMEOUT) {
         sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -1216,7 +1216,7 @@ static struct connection_closure *
 connection_closure_alloc(int sock)
 {
     struct connection_closure *closure;
-    debug_decl(connection_closure_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(connection_closure_alloc, SUDO_DEBUG_UTIL);
 
     if ((closure = calloc(1, sizeof(*closure))) == NULL)
 	debug_return_ptr(NULL);
@@ -1268,7 +1268,7 @@ new_connection(int sock, struct sudo_event_base *base)
 {
     struct connection_closure *closure;
 
-    debug_decl(new_connection, SUDO_DEBUG_UTIL)
+    debug_decl(new_connection, SUDO_DEBUG_UTIL);
 
     if ((closure = connection_closure_alloc(sock)) == NULL)
 	goto bad;
@@ -1329,7 +1329,7 @@ static int
 create_listener(struct listen_address *addr)
 {
     int flags, i, sock;
-    debug_decl(create_listener, SUDO_DEBUG_UTIL)
+    debug_decl(create_listener, SUDO_DEBUG_UTIL);
 
     if ((sock = socket(addr->sa_un.sa.sa_family, SOCK_STREAM, 0)) == -1) {
 	sudo_warn("socket");
@@ -1366,7 +1366,7 @@ listener_cb(int fd, int what, void *v)
     union sockaddr_union s_un;
     socklen_t salen = sizeof(s_un);
     int sock;
-    debug_decl(listener_cb, SUDO_DEBUG_UTIL)
+    debug_decl(listener_cb, SUDO_DEBUG_UTIL);
 
     sock = accept(fd, &s_un.sa, &salen);
     if (sock != -1) {
@@ -1390,7 +1390,7 @@ register_listener(struct listen_address *addr, struct sudo_event_base *base)
 {
     struct sudo_event *ev;
     int sock;
-    debug_decl(register_listener, SUDO_DEBUG_UTIL)
+    debug_decl(register_listener, SUDO_DEBUG_UTIL);
 
     sock = create_listener(addr);
 
@@ -1409,7 +1409,7 @@ static void
 register_signal(int signo, struct sudo_event_base *base)
 {
     struct sudo_event *ev;
-    debug_decl(register_signal, SUDO_DEBUG_UTIL)
+    debug_decl(register_signal, SUDO_DEBUG_UTIL);
 
     ev = sudo_ev_alloc(signo, SUDO_EV_SIGNAL, signal_cb, base);
     if (ev == NULL)
@@ -1434,7 +1434,7 @@ static void
 daemonize(bool nofork)
 {
     int fd;
-    debug_decl(daemonize, SUDO_DEBUG_UTIL)
+    debug_decl(daemonize, SUDO_DEBUG_UTIL);
 
     if (!nofork) {
 	switch (fork()) {
@@ -1508,7 +1508,7 @@ main(int argc, char *argv[])
     bool nofork = false;
     char *ep;
     int ch;
-    debug_decl_vars(main, SUDO_DEBUG_MAIN)
+    debug_decl_vars(main, SUDO_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     {
diff --git a/logsrvd/logsrvd_conf.c b/logsrvd/logsrvd_conf.c
index 2b5153a93..fb1056d3e 100644
--- a/logsrvd/logsrvd_conf.c
+++ b/logsrvd/logsrvd_conf.c
@@ -225,7 +225,7 @@ logsrvd_conf_logfile_time_format(void)
 static bool
 cb_iolog_dir(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_iolog_dir, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_dir, SUDO_DEBUG_UTIL);
 
     free(config->iolog.iolog_dir);
     if ((config->iolog.iolog_dir = strdup(path)) == NULL) {
@@ -238,7 +238,7 @@ cb_iolog_dir(struct logsrvd_config *config, const char *path)
 static bool
 cb_iolog_file(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_iolog_file, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_file, SUDO_DEBUG_UTIL);
 
     free(config->iolog.iolog_file);
     if ((config->iolog.iolog_file = strdup(path)) == NULL) {
@@ -252,7 +252,7 @@ static bool
 cb_iolog_compress(struct logsrvd_config *config, const char *str)
 {
     int val;
-    debug_decl(cb_iolog_compress, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_compress, SUDO_DEBUG_UTIL);
 
     if ((val = sudo_strtobool(str)) == -1)
 	debug_return_bool(false);
@@ -265,7 +265,7 @@ static bool
 cb_iolog_flush(struct logsrvd_config *config, const char *str)
 {
     int val;
-    debug_decl(cb_iolog_flush, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_flush, SUDO_DEBUG_UTIL);
 
     if ((val = sudo_strtobool(str)) == -1)
 	debug_return_bool(false);
@@ -278,7 +278,7 @@ static bool
 cb_iolog_user(struct logsrvd_config *config, const char *user)
 {
     struct passwd *pw;
-    debug_decl(cb_iolog_user, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_user, SUDO_DEBUG_UTIL);
 
     if ((pw = getpwnam(user)) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -296,7 +296,7 @@ static bool
 cb_iolog_group(struct logsrvd_config *config, const char *group)
 {
     struct group *gr;
-    debug_decl(cb_iolog_group, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_group, SUDO_DEBUG_UTIL);
 
     if ((gr = getgrnam(group)) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -314,7 +314,7 @@ cb_iolog_mode(struct logsrvd_config *config, const char *str)
 {
     const char *errstr;
     mode_t mode;
-    debug_decl(cb_iolog_mode, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_mode, SUDO_DEBUG_UTIL);
 
     mode = sudo_strtomode(str, &errstr);
     if (errstr != NULL) {
@@ -331,7 +331,7 @@ cb_iolog_maxseq(struct logsrvd_config *config, const char *str)
 {
     const char *errstr;
     unsigned int value;
-    debug_decl(cb_iolog_maxseq, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_maxseq, SUDO_DEBUG_UTIL);
 
     value = sudo_strtonum(str, 0, SESSID_MAX, &errstr);
     if (errstr != NULL) {
@@ -356,7 +356,7 @@ cb_listen_address(struct logsrvd_config *config, const char *str)
     char *copy, *host, *port;
     bool ret = false;
     int error;
-    debug_decl(cb_iolog_mode, SUDO_DEBUG_UTIL)
+    debug_decl(cb_iolog_mode, SUDO_DEBUG_UTIL);
 
     if ((copy = strdup(str)) == NULL) {
 	sudo_warn(NULL);
@@ -404,7 +404,7 @@ cb_timeout(struct logsrvd_config *config, const char *str)
 {
     int timeout;
     const char* errstr;
-    debug_decl(cb_timeout, SUDO_DEBUG_UTIL)
+    debug_decl(cb_timeout, SUDO_DEBUG_UTIL);
 
     timeout = sudo_strtonum(str, 0, UINT_MAX, &errstr);
     if (errstr != NULL)
@@ -420,7 +420,7 @@ static bool
 cb_tls_opt(struct logsrvd_config *config, const char *str)
 {
     int val;
-    debug_decl(cb_tls_opt, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_opt, SUDO_DEBUG_UTIL);
 
     if ((val = sudo_strtobool(str)) == -1)
 	debug_return_bool(false);
@@ -432,7 +432,7 @@ cb_tls_opt(struct logsrvd_config *config, const char *str)
 static bool
 cb_tls_key(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_tls_key, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_key, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.pkey_path);
     if ((config->server.tls_config.pkey_path = strdup(path)) == NULL) {
@@ -445,7 +445,7 @@ cb_tls_key(struct logsrvd_config *config, const char *path)
 static bool
 cb_tls_cacert(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_tls_cacert, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_cacert, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.cacert_path);
     if ((config->server.tls_config.cacert_path = strdup(path)) == NULL) {
@@ -458,7 +458,7 @@ cb_tls_cacert(struct logsrvd_config *config, const char *path)
 static bool
 cb_tls_cert(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_tls_cert, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_cert, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.cert_path);
     if ((config->server.tls_config.cert_path = strdup(path)) == NULL) {
@@ -471,7 +471,7 @@ cb_tls_cert(struct logsrvd_config *config, const char *path)
 static bool
 cb_tls_dhparam(struct logsrvd_config *config, const char *path)
 {
-    debug_decl(cb_tls_dhparam, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_dhparam, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.dhparams_path);
     if ((config->server.tls_config.dhparams_path = strdup(path)) == NULL) {
@@ -484,7 +484,7 @@ cb_tls_dhparam(struct logsrvd_config *config, const char *path)
 static bool
 cb_tls_ciphers12(struct logsrvd_config *config, const char *str)
 {
-    debug_decl(cb_tls_ciphers12, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_ciphers12, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.ciphers_v12);
     if ((config->server.tls_config.ciphers_v12 = strdup(str)) == NULL) {
@@ -497,7 +497,7 @@ cb_tls_ciphers12(struct logsrvd_config *config, const char *str)
 static bool
 cb_tls_ciphers13(struct logsrvd_config *config, const char *str)
 {
-    debug_decl(cb_tls_ciphers13, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_ciphers13, SUDO_DEBUG_UTIL);
 
     free(config->server.tls_config.ciphers_v13);
     if ((config->server.tls_config.ciphers_v13 = strdup(str)) == NULL) {
@@ -511,7 +511,7 @@ static bool
 cb_tls_checkpeer(struct logsrvd_config *config, const char *str)
 {
     int val;
-    debug_decl(cb_tls_checkpeer, SUDO_DEBUG_UTIL)
+    debug_decl(cb_tls_checkpeer, SUDO_DEBUG_UTIL);
 
     if ((val = sudo_strtobool(str)) == -1)
 	debug_return_bool(false);
@@ -525,7 +525,7 @@ cb_tls_checkpeer(struct logsrvd_config *config, const char *str)
 static bool
 cb_eventlog_type(struct logsrvd_config *config, const char *str)
 {
-    debug_decl(cb_eventlog_type, SUDO_DEBUG_UTIL)
+    debug_decl(cb_eventlog_type, SUDO_DEBUG_UTIL);
 
     if (strcmp(str, "none") == 0)
 	config->eventlog.log_type = EVLOG_NONE;
@@ -542,7 +542,7 @@ cb_eventlog_type(struct logsrvd_config *config, const char *str)
 static bool
 cb_eventlog_format(struct logsrvd_config *config, const char *str)
 {
-    debug_decl(cb_eventlog_format, SUDO_DEBUG_UTIL)
+    debug_decl(cb_eventlog_format, SUDO_DEBUG_UTIL);
 
     if (strcmp(str, "sudo") == 0)
 	config->eventlog.log_format = EVLOG_SUDO;
@@ -558,7 +558,7 @@ cb_syslog_maxlen(struct logsrvd_config *config, const char *str)
 {
     unsigned int maxlen;
     const char *errstr;
-    debug_decl(cb_syslog_maxlen, SUDO_DEBUG_UTIL)
+    debug_decl(cb_syslog_maxlen, SUDO_DEBUG_UTIL);
 
     maxlen = sudo_strtonum(str, 1, UINT_MAX, &errstr);
     if (errstr != NULL)
@@ -573,7 +573,7 @@ static bool
 cb_syslog_facility(struct logsrvd_config *config, const char *str)
 {
     int logfac;
-    debug_decl(cb_syslog_facility, SUDO_DEBUG_UTIL)
+    debug_decl(cb_syslog_facility, SUDO_DEBUG_UTIL);
 
     if (!sudo_str2logfac(str, &logfac)) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -590,7 +590,7 @@ static bool
 cb_syslog_acceptpri(struct logsrvd_config *config, const char *str)
 {
     int logpri;
-    debug_decl(cb_syslog_acceptpri, SUDO_DEBUG_UTIL)
+    debug_decl(cb_syslog_acceptpri, SUDO_DEBUG_UTIL);
 
     if (!sudo_str2logpri(str, &logpri)) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -607,7 +607,7 @@ static bool
 cb_syslog_rejectpri(struct logsrvd_config *config, const char *str)
 {
     int logpri;
-    debug_decl(cb_syslog_rejectpri, SUDO_DEBUG_UTIL)
+    debug_decl(cb_syslog_rejectpri, SUDO_DEBUG_UTIL);
 
     if (!sudo_str2logpri(str, &logpri))
 	debug_return_bool(false);
@@ -621,7 +621,7 @@ static bool
 cb_syslog_alertpri(struct logsrvd_config *config, const char *str)
 {
     int logpri;
-    debug_decl(cb_syslog_alertpri, SUDO_DEBUG_UTIL)
+    debug_decl(cb_syslog_alertpri, SUDO_DEBUG_UTIL);
 
     if (!sudo_str2logpri(str, &logpri)) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -639,7 +639,7 @@ static bool
 cb_logfile_path(struct logsrvd_config *config, const char *str)
 {
     char *copy = NULL;
-    debug_decl(cb_logfile_path, SUDO_DEBUG_UTIL)
+    debug_decl(cb_logfile_path, SUDO_DEBUG_UTIL);
 
     if (*str != '/') {
 	debug_return_bool(false);
@@ -661,7 +661,7 @@ static bool
 cb_logfile_time_format(struct logsrvd_config *config, const char *str)
 {
     char *copy = NULL;
-    debug_decl(cb_logfile_time_format, SUDO_DEBUG_UTIL)
+    debug_decl(cb_logfile_time_format, SUDO_DEBUG_UTIL);
 
     if ((copy = strdup(str)) == NULL) {
 	sudo_warn(NULL);
@@ -740,7 +740,7 @@ logsrvd_conf_parse(struct logsrvd_config *config, FILE *fp, const char *path)
     size_t linesize = 0;
     char *line = NULL;
     bool ret = false;
-    debug_decl(logsrvd_conf_parse, SUDO_DEBUG_UTIL)
+    debug_decl(logsrvd_conf_parse, SUDO_DEBUG_UTIL);
 
     while (sudo_parseln(&line, &linesize, &lineno, fp, 0) != -1) {
 	struct logsrvd_config_entry *entry;
@@ -818,7 +818,7 @@ void
 logsrvd_conf_free(struct logsrvd_config *config)
 {
     struct listen_address *addr;
-    debug_decl(logsrvd_conf_free, SUDO_DEBUG_UTIL)
+    debug_decl(logsrvd_conf_free, SUDO_DEBUG_UTIL);
 
     if (config == NULL)
 	debug_return;
@@ -847,7 +847,7 @@ struct logsrvd_config *
 logsrvd_conf_alloc(void)
 {
     struct logsrvd_config *config;
-    debug_decl(logsrvd_conf_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(logsrvd_conf_alloc, SUDO_DEBUG_UTIL);
 
     if ((config = calloc(1, sizeof(*config))) == NULL) {
 	sudo_warn(NULL);
@@ -914,7 +914,7 @@ bad:
 bool
 logsrvd_conf_apply(struct logsrvd_config *config)
 {
-    debug_decl(logsrvd_conf_apply, SUDO_DEBUG_UTIL)
+    debug_decl(logsrvd_conf_apply, SUDO_DEBUG_UTIL);
 
     /* There can be multiple addresses so we can't set a default earlier. */
     if (TAILQ_EMPTY(&config->server.addresses)) {
@@ -946,7 +946,7 @@ logsrvd_conf_read(const char *path)
     struct logsrvd_config *config;
     bool ret = false;
     FILE *fp = NULL;
-    debug_decl(logsrvd_conf_read, SUDO_DEBUG_UTIL)
+    debug_decl(logsrvd_conf_read, SUDO_DEBUG_UTIL);
 
     config = logsrvd_conf_alloc();
 
diff --git a/logsrvd/sendlog.c b/logsrvd/sendlog.c
index 75de7d27b..c23f7de99 100644
--- a/logsrvd/sendlog.c
+++ b/logsrvd/sendlog.c
@@ -124,7 +124,7 @@ init_tls_client_context(const char *ca_bundle_file, const char *cert_file, const
 {
     const SSL_METHOD *method;
     SSL_CTX *ctx = NULL;
-    debug_decl(init_tls_client_context, SUDO_DEBUG_UTIL)
+    debug_decl(init_tls_client_context, SUDO_DEBUG_UTIL);
 
     SSL_library_init();
     OpenSSL_add_all_algorithms();
@@ -185,7 +185,7 @@ tls_connect_cb(int sock, int what, void *v)
     struct timespec timeo = { TLS_HANDSHAKE_TIMEO_SEC, 0 };
     int con_stat, err;
 
-    debug_decl(tls_connect_cb, SUDO_DEBUG_UTIL)
+    debug_decl(tls_connect_cb, SUDO_DEBUG_UTIL);
 
     if (what == SUDO_EV_TIMEOUT) {
         sudo_warnx(U_("TLS handshake timeout occured"));
@@ -226,7 +226,7 @@ tls_connect_async(struct client_closure *closure)
 {
     struct sudo_event_base *evbase = NULL;
 
-    debug_decl(tls_connect_async, SUDO_DEBUG_UTIL)
+    debug_decl(tls_connect_async, SUDO_DEBUG_UTIL);
 
 	evbase = sudo_ev_base_alloc();
 	closure->tls_connect_ev = sudo_ev_alloc(closure->sock, SUDO_EV_WRITE,
@@ -255,7 +255,7 @@ done:
 static bool
 do_tls_handshake(struct client_closure *closure)
 {
-    debug_decl(do_tls_handshake, SUDO_DEBUG_UTIL)
+    debug_decl(do_tls_handshake, SUDO_DEBUG_UTIL);
 
     if (ca_bundle == NULL) {
         sudo_warnx("%s", U_("CA bundle file was not specified"));
@@ -305,7 +305,7 @@ connect_server(const char *host, const char *port)
     struct addrinfo hints, *res, *res0;
     const char *cause = "getaddrinfo";
     int error, sock, save_errno;
-    debug_decl(connect_server, SUDO_DEBUG_UTIL)
+    debug_decl(connect_server, SUDO_DEBUG_UTIL);
 
     memset(&hints, 0, sizeof(hints));
     hints.ai_family = AF_UNSPEC;
@@ -358,7 +358,7 @@ connect_server(const char *host, const char *port)
 static void
 client_closure_free(struct client_closure *closure)
 {
-    debug_decl(client_closure_free, SUDO_DEBUG_UTIL)
+    debug_decl(client_closure_free, SUDO_DEBUG_UTIL);
 
     if (closure != NULL) {
 	sudo_ev_free(closure->read_ev);
@@ -380,7 +380,7 @@ read_io_buf(struct client_closure *closure)
     struct timing_closure *timing = &closure->timing;
     const char *errstr = NULL;
     size_t nread;
-    debug_decl(read_io_buf, SUDO_DEBUG_UTIL)
+    debug_decl(read_io_buf, SUDO_DEBUG_UTIL);
 
     if (!iolog_files[timing->event].enabled) {
 	errno = ENOENT;
@@ -419,7 +419,7 @@ fmt_client_message(struct connection_buffer *buf, ClientMessage *msg)
     uint32_t msg_len;
     bool ret = false;
     size_t len;
-    debug_decl(fmt_client_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_client_message, SUDO_DEBUG_UTIL);
 
     len = client_message__get_packed_size(msg);
     if (len > MESSAGE_SIZE_MAX) {
@@ -462,7 +462,7 @@ split_command(char *command, size_t *lenp)
     char *cp;
     char **args;
     size_t len;
-    debug_decl(split_command, SUDO_DEBUG_UTIL)
+    debug_decl(split_command, SUDO_DEBUG_UTIL);
 
     for (cp = command, len = 0;;) {
 	len++;
@@ -501,7 +501,7 @@ fmt_accept_message(struct client_closure *closure)
     char *hostname;
     bool ret = false;
     size_t n;
-    debug_decl(fmt_accept_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_accept_message, SUDO_DEBUG_UTIL);
 
     /*
      * Fill in AcceptMessage and add it to ClientMessage.
@@ -631,7 +631,7 @@ fmt_restart_message(struct client_closure *closure)
     RestartMessage restart_msg = RESTART_MESSAGE__INIT;
     TimeSpec tv = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_restart_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_restart_message, SUDO_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO,
 	"%s: sending RestartMessage, [%lld, %ld]", __func__,
@@ -665,7 +665,7 @@ fmt_exit_message(struct client_closure *closure)
     ClientMessage client_msg = CLIENT_MESSAGE__INIT;
     ExitMessage exit_msg = EXIT_MESSAGE__INIT;
     bool ret = false;
-    debug_decl(fmt_exit_message, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_exit_message, SUDO_DEBUG_UTIL);
 
     /*
      * We don't have enough data in a sudo I/O log to create a real
@@ -703,7 +703,7 @@ fmt_io_buf(int type, struct client_closure *closure,
     IoBuffer iobuf_msg = IO_BUFFER__INIT;
     TimeSpec delay = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_io_buf, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_io_buf, SUDO_DEBUG_UTIL);
 
     if (!read_io_buf(closure))
 	goto done;
@@ -745,7 +745,7 @@ fmt_winsize(struct client_closure *closure, struct connection_buffer *buf)
     TimeSpec delay = TIME_SPEC__INIT;
     struct timing_closure *timing = &closure->timing;
     bool ret = false;
-    debug_decl(fmt_winsize, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_winsize, SUDO_DEBUG_UTIL);
 
     /* Fill in ChangeWindowSize message. */
     delay.tv_sec = timing->delay.tv_sec;
@@ -782,7 +782,7 @@ fmt_suspend(struct client_closure *closure, struct connection_buffer *buf)
     TimeSpec delay = TIME_SPEC__INIT;
     struct timing_closure *timing = &closure->timing;
     bool ret = false;
-    debug_decl(fmt_suspend, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_suspend, SUDO_DEBUG_UTIL);
 
     /* Fill in CommandSuspend message. */
     delay.tv_sec = timing->delay.tv_sec;
@@ -818,7 +818,7 @@ fmt_next_iolog(struct client_closure *closure)
     struct timing_closure *timing = &closure->timing;
     struct connection_buffer *buf = &closure->write_buf;
     bool ret = false;
-    debug_decl(fmt_next_iolog, SUDO_DEBUG_UTIL)
+    debug_decl(fmt_next_iolog, SUDO_DEBUG_UTIL);
 
     if (buf->len != 0) {
 	sudo_warnx(U_("%s: write buffer already in use"), __func__);
@@ -887,7 +887,7 @@ again:
 static bool
 client_message_completion(struct client_closure *closure)
 {
-    debug_decl(client_message_completion, SUDO_DEBUG_UTIL)
+    debug_decl(client_message_completion, SUDO_DEBUG_UTIL);
 
     switch (closure->state) {
     case SEND_ACCEPT:
@@ -919,7 +919,7 @@ static bool
 handle_server_hello(ServerHello *msg, struct client_closure *closure)
 {
     size_t n;
-    debug_decl(handle_server_hello, SUDO_DEBUG_UTIL)
+    debug_decl(handle_server_hello, SUDO_DEBUG_UTIL);
 
     if (closure->state != RECV_HELLO) {
 	sudo_warnx(U_("%s: unexpected state %d"), __func__, closure->state);
@@ -960,7 +960,7 @@ handle_server_hello(ServerHello *msg, struct client_closure *closure)
 static bool
 handle_commit_point(TimeSpec *commit_point, struct client_closure *closure)
 {
-    debug_decl(handle_commit_point, SUDO_DEBUG_UTIL)
+    debug_decl(handle_commit_point, SUDO_DEBUG_UTIL);
 
     /* Only valid after we have sent an IO buffer. */
     if (closure->state < SEND_IO) {
@@ -983,7 +983,7 @@ handle_commit_point(TimeSpec *commit_point, struct client_closure *closure)
 static bool
 handle_log_id(char *id, struct client_closure *closure)
 {
-    debug_decl(handle_log_id, SUDO_DEBUG_UTIL)
+    debug_decl(handle_log_id, SUDO_DEBUG_UTIL);
 
     printf("remote log ID: %s\n", id);
     if ((closure->iolog_id = strdup(id)) == NULL)
@@ -998,7 +998,7 @@ handle_log_id(char *id, struct client_closure *closure)
 static bool
 handle_server_error(char *errmsg, struct client_closure *closure)
 {
-    debug_decl(handle_server_error, SUDO_DEBUG_UTIL)
+    debug_decl(handle_server_error, SUDO_DEBUG_UTIL);
 
     sudo_warnx(U_("error message received from server: %s"), errmsg);
     debug_return_bool(false);
@@ -1011,7 +1011,7 @@ handle_server_error(char *errmsg, struct client_closure *closure)
 static bool
 handle_server_abort(char *errmsg, struct client_closure *closure)
 {
-    debug_decl(handle_server_abort, SUDO_DEBUG_UTIL)
+    debug_decl(handle_server_abort, SUDO_DEBUG_UTIL);
 
     sudo_warnx(U_("abort message received from server: %s"), errmsg);
     debug_return_bool(false);
@@ -1027,7 +1027,7 @@ handle_server_message(uint8_t *buf, size_t len,
 {
     ServerMessage *msg;
     bool ret = false;
-    debug_decl(handle_server_message, SUDO_DEBUG_UTIL)
+    debug_decl(handle_server_message, SUDO_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: unpacking ServerMessage", __func__);
     msg = server_message__unpack(NULL, len, buf);
@@ -1095,7 +1095,7 @@ server_msg_cb(int fd, int what, void *v)
     struct connection_buffer *buf = &closure->read_buf;
     ssize_t nread;
     uint32_t msg_len;
-    debug_decl(server_msg_cb, SUDO_DEBUG_UTIL)
+    debug_decl(server_msg_cb, SUDO_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: reading ServerMessage", __func__);
 
@@ -1185,7 +1185,7 @@ client_msg_cb(int fd, int what, void *v)
     struct client_closure *closure = v;
     struct connection_buffer *buf = &closure->write_buf;
     ssize_t nwritten;
-    debug_decl(client_msg_cb, SUDO_DEBUG_UTIL)
+    debug_decl(client_msg_cb, SUDO_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO,
     	"%s: sending %u bytes to server", __func__, buf->len - buf->off);
@@ -1247,7 +1247,7 @@ client_closure_fill(struct client_closure *closure, int sock,
     struct timespec *elapsed, struct timespec *restart, const char *iolog_id,
     struct iolog_info *log_info)
 {
-    debug_decl(client_closure_fill, SUDO_DEBUG_UTIL)
+    debug_decl(client_closure_fill, SUDO_DEBUG_UTIL);
 
     memset(closure, 0, sizeof(*closure));
 
@@ -1296,7 +1296,7 @@ parse_timespec(struct timespec *ts, const char *strval)
     long long tv_sec;
     long tv_nsec;
     char *ep;
-    debug_decl(parse_timespec, SUDO_DEBUG_UTIL)
+    debug_decl(parse_timespec, SUDO_DEBUG_UTIL);
 
     errno = 0;
     tv_sec = strtoll(strval, &ep, 10);
@@ -1360,7 +1360,7 @@ main(int argc, char *argv[])
     const char *open_mode = "r";
     int ch, sock, iolog_dir_fd, fd;
     FILE *fp;
-    debug_decl_vars(main, SUDO_DEBUG_MAIN)
+    debug_decl_vars(main, SUDO_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     {
diff --git a/plugins/python/python_plugin_common.c b/plugins/python/python_plugin_common.c
index ae84ee97e..ecc747c0f 100644
--- a/plugins/python/python_plugin_common.c
+++ b/plugins/python/python_plugin_common.c
@@ -188,7 +188,7 @@ python_plugin_register_logging(sudo_conv_t conversation,
                                sudo_printf_t sudo_printf,
                                char * const settings[])
 {
-    debug_decl(python_plugin_register_logging, PYTHON_DEBUG_INTERNAL)
+    debug_decl(python_plugin_register_logging, PYTHON_DEBUG_INTERNAL);
 
     int rc = SUDO_RC_ERROR;
     if (py_ctx.sudo_conv == NULL)
diff --git a/plugins/python/sudo_python_debug.c b/plugins/python/sudo_python_debug.c
index 4aeb44c67..c13ff1955 100644
--- a/plugins/python/sudo_python_debug.c
+++ b/plugins/python/sudo_python_debug.c
@@ -139,7 +139,7 @@ python_debug_register(const char *program,
 void
 python_debug_deregister(void)
 {
-    debug_decl(python_debug_deregister, PYTHON_DEBUG_INTERNAL)
+    debug_decl(python_debug_deregister, PYTHON_DEBUG_INTERNAL);
 
     if (python_debug_instance != SUDO_DEBUG_INSTANCE_INITIALIZER) {
         sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
diff --git a/plugins/sudoers/alias.c b/plugins/sudoers/alias.c
index adbf946d7..b8a4958c6 100644
--- a/plugins/sudoers/alias.c
+++ b/plugins/sudoers/alias.c
@@ -55,7 +55,7 @@ alias_compare(const void *v1, const void *v2)
     const struct alias *a1 = (const struct alias *)v1;
     const struct alias *a2 = (const struct alias *)v2;
     int res;
-    debug_decl(alias_compare, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_compare, SUDOERS_DEBUG_ALIAS);
 
     if (a1 == NULL)
 	res = -1;
@@ -78,7 +78,7 @@ alias_get(struct sudoers_parse_tree *parse_tree, const char *name, int type)
     struct alias key;
     struct rbnode *node;
     struct alias *a = NULL;
-    debug_decl(alias_get, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_get, SUDOERS_DEBUG_ALIAS);
 
     if (parse_tree->aliases == NULL)
 	debug_return_ptr(NULL);
@@ -109,7 +109,7 @@ alias_get(struct sudoers_parse_tree *parse_tree, const char *name, int type)
 void
 alias_put(struct alias *a)
 {
-    debug_decl(alias_put, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_put, SUDOERS_DEBUG_ALIAS);
     a->used = false;
     debug_return;
 }
@@ -125,7 +125,7 @@ alias_add(struct sudoers_parse_tree *parse_tree, char *name, int type,
 {
     static char errbuf[512];
     struct alias *a;
-    debug_decl(alias_add, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_add, SUDOERS_DEBUG_ALIAS);
 
     if (parse_tree->aliases == NULL) {
 	if ((parse_tree->aliases = alloc_aliases()) == NULL) {
@@ -187,7 +187,7 @@ alias_apply(struct sudoers_parse_tree *parse_tree,
     void *cookie)
 {
     struct alias_apply_closure closure;
-    debug_decl(alias_apply, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_apply, SUDOERS_DEBUG_ALIAS);
 
     if (parse_tree->aliases != NULL) {
 	closure.parse_tree = parse_tree;
@@ -205,7 +205,7 @@ alias_apply(struct sudoers_parse_tree *parse_tree,
 bool
 no_aliases(struct sudoers_parse_tree *parse_tree)
 {
-    debug_decl(no_aliases, SUDOERS_DEBUG_ALIAS)
+    debug_decl(no_aliases, SUDOERS_DEBUG_ALIAS);
     debug_return_bool(parse_tree->aliases == NULL ||
 	rbisempty(parse_tree->aliases));
 }
@@ -217,7 +217,7 @@ void
 alias_free(void *v)
 {
     struct alias *a = (struct alias *)v;
-    debug_decl(alias_free, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_free, SUDOERS_DEBUG_ALIAS);
 
     if (a != NULL) {
 	free(a->name);
@@ -237,7 +237,7 @@ alias_remove(struct sudoers_parse_tree *parse_tree, char *name, int type)
 {
     struct rbnode *node;
     struct alias key;
-    debug_decl(alias_remove, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_remove, SUDOERS_DEBUG_ALIAS);
 
     if (parse_tree->aliases != NULL) {
 	key.name = name;
@@ -252,7 +252,7 @@ alias_remove(struct sudoers_parse_tree *parse_tree, char *name, int type)
 struct rbtree *
 alloc_aliases(void)
 {
-    debug_decl(alloc_aliases, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alloc_aliases, SUDOERS_DEBUG_ALIAS);
 
     debug_return_ptr(rbcreate(alias_compare));
 }
@@ -260,7 +260,7 @@ alloc_aliases(void)
 void
 free_aliases(struct rbtree *aliases)
 {
-    debug_decl(free_aliases, SUDOERS_DEBUG_ALIAS)
+    debug_decl(free_aliases, SUDOERS_DEBUG_ALIAS);
 
     if (aliases != NULL)
 	rbdestroy(aliases, alias_free);
@@ -287,7 +287,7 @@ alias_remove_recursive(struct sudoers_parse_tree *parse_tree, char *name,
     struct member *m;
     struct alias *a;
     bool ret = true;
-    debug_decl(alias_remove_recursive, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_remove_recursive, SUDOERS_DEBUG_ALIAS);
 
     if ((a = alias_remove(parse_tree, name, type)) != NULL) {
 	TAILQ_FOREACH(m, &a->members, entries) {
@@ -308,7 +308,7 @@ alias_find_used_members(struct sudoers_parse_tree *parse_tree,
 {
     struct member *m;
     int errors = 0;
-    debug_decl(alias_find_used_members, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_find_used_members, SUDOERS_DEBUG_ALIAS);
 
     if (members != NULL) {
 	TAILQ_FOREACH(m, members, entries) {
@@ -334,7 +334,7 @@ alias_find_used(struct sudoers_parse_tree *parse_tree, struct rbtree *used_alias
     struct defaults *d;
     struct member *m;
     int errors = 0;
-    debug_decl(alias_find_used, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_find_used, SUDOERS_DEBUG_ALIAS);
 
     /* Move referenced aliases to used_aliases. */
     TAILQ_FOREACH(us, &parse_tree->userspecs, entries) {
diff --git a/plugins/sudoers/audit.c b/plugins/sudoers/audit.c
index 08d32e39b..a5cc56fb8 100644
--- a/plugins/sudoers/audit.c
+++ b/plugins/sudoers/audit.c
@@ -43,7 +43,7 @@ int
 audit_success(int argc, char *argv[])
 {
     int rc = 0;
-    debug_decl(audit_success, SUDOERS_DEBUG_AUDIT)
+    debug_decl(audit_success, SUDOERS_DEBUG_AUDIT);
 
     if (!def_log_allowed)
 	debug_return_int(0);
@@ -70,7 +70,7 @@ int
 audit_failure(int argc, char *argv[], char const *const fmt, ...)
 {
     int rc = 0;
-    debug_decl(audit_success, SUDOERS_DEBUG_AUDIT)
+    debug_decl(audit_success, SUDOERS_DEBUG_AUDIT);
 
     if (!def_log_denied)
 	debug_return_int(0);
diff --git a/plugins/sudoers/auth/afs.c b/plugins/sudoers/auth/afs.c
index 52f17a1d3..b0721a0dd 100644
--- a/plugins/sudoers/auth/afs.c
+++ b/plugins/sudoers/auth/afs.c
@@ -53,7 +53,7 @@ sudo_afs_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv
 {
     struct ktc_encryptionKey afs_key;
     struct ktc_token afs_token;
-    debug_decl(sudo_afs_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_afs_verify, SUDOERS_DEBUG_AUTH);
 
     /* Try to just check the password */
     ka_StringToKey(pass, NULL, &afs_key);
diff --git a/plugins/sudoers/auth/aix_auth.c b/plugins/sudoers/auth/aix_auth.c
index bb62612e2..a23f14c9d 100644
--- a/plugins/sudoers/auth/aix_auth.c
+++ b/plugins/sudoers/auth/aix_auth.c
@@ -68,7 +68,7 @@ sudo_aix_authtype(void)
     bool in_stanza = false;
     int authtype = AIX_AUTH_UNKNOWN;
     FILE *fp;
-    debug_decl(sudo_aix_authtype, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_authtype, SUDOERS_DEBUG_AUTH);
 
     if ((fp = fopen("/etc/security/login.cfg", "r")) == NULL)
 	debug_return_int(AIX_AUTH_UNKNOWN);
@@ -136,7 +136,7 @@ sudo_aix_authtype(void)
 int
 sudo_aix_init(struct passwd *pw, sudo_auth *auth)
 {
-    debug_decl(sudo_aix_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_init, SUDOERS_DEBUG_AUTH);
 
 #ifdef HAVE_PAM
     /* Check auth_type in /etc/security/login.cfg. */
@@ -156,7 +156,7 @@ sudo_aix_valid_message(const char *message)
 {
     const char *cp;
     const char badpass_msgid[] = "3004-300";
-    debug_decl(sudo_aix_valid_message, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_valid_message, SUDOERS_DEBUG_AUTH);
 
     if (message == NULL || message[0] == '\0')
 	debug_return_bool(false);
@@ -188,7 +188,7 @@ sudo_aix_change_password(const char *user)
     bool ret = false;
     sigset_t mask;
     int status;
-    debug_decl(sudo_aix_change_password, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_change_password, SUDOERS_DEBUG_AUTH);
 
     /* Set SIGCHLD handler to default since we call waitpid() below. */
     memset(&sa, 0, sizeof(sa));                
@@ -239,7 +239,7 @@ sudo_aix_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_co
     char *pass, *message = NULL;
     int result = 1, reenter = 0;
     int ret = AUTH_SUCCESS;
-    debug_decl(sudo_aix_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_verify, SUDOERS_DEBUG_AUTH);
 
     do {
 	pass = auth_getpass(prompt, SUDO_CONV_PROMPT_ECHO_OFF, callback);
@@ -302,7 +302,7 @@ sudo_aix_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_co
 int
 sudo_aix_cleanup(struct passwd *pw, sudo_auth *auth)
 {
-    debug_decl(sudo_aix_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_aix_cleanup, SUDOERS_DEBUG_AUTH);
 
     /* Unset AUTHSTATE as it may not be correct for the runas user. */
     if (sudo_unsetenv("AUTHSTATE") == -1)
diff --git a/plugins/sudoers/auth/bsdauth.c b/plugins/sudoers/auth/bsdauth.c
index f97662375..c4b673fb6 100644
--- a/plugins/sudoers/auth/bsdauth.c
+++ b/plugins/sudoers/auth/bsdauth.c
@@ -63,7 +63,7 @@ int
 bsdauth_init(struct passwd *pw, sudo_auth *auth)
 {
     static struct bsdauth_state state;
-    debug_decl(bsdauth_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(bsdauth_init, SUDOERS_DEBUG_AUTH);
 
     /* Get login class based on auth user, which may not be invoking user. */
     if (pw->pw_class && *pw->pw_class)
@@ -113,7 +113,7 @@ bsdauth_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_con
     int authok = 0;
     struct sigaction sa, osa;
     auth_session_t *as = ((struct bsdauth_state *) auth->data)->as;
-    debug_decl(bsdauth_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(bsdauth_verify, SUDOERS_DEBUG_AUTH);
 
     /* save old signal handler */
     sigemptyset(&sa.sa_mask);
@@ -178,7 +178,7 @@ int
 bsdauth_approval(struct passwd *pw, sudo_auth *auth, bool exempt)
 {
     struct bsdauth_state *state = auth->data;
-    debug_decl(bsdauth_approval, SUDOERS_DEBUG_AUTH)
+    debug_decl(bsdauth_approval, SUDOERS_DEBUG_AUTH);
 
     if (auth_approval(state->as, state->lc, pw->pw_name, "auth-sudo") == 0) {
 	if (auth_getstate(state->as) & AUTH_EXPIRED)
@@ -194,7 +194,7 @@ int
 bsdauth_cleanup(struct passwd *pw, sudo_auth *auth)
 {
     struct bsdauth_state *state = auth->data;
-    debug_decl(bsdauth_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(bsdauth_cleanup, SUDOERS_DEBUG_AUTH);
 
     if (state != NULL) {
 	auth_close(state->as);
diff --git a/plugins/sudoers/auth/dce.c b/plugins/sudoers/auth/dce.c
index 27bd059fc..0c6b4063d 100644
--- a/plugins/sudoers/auth/dce.c
+++ b/plugins/sudoers/auth/dce.c
@@ -71,7 +71,7 @@ sudo_dce_verify(struct passwd *pw, char *plain_pw, sudo_auth *auth, struct sudo_
     boolean32			reset_passwd;
     sec_login_auth_src_t	auth_src;
     error_status_t		status;
-    debug_decl(sudo_dce_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_dce_verify, SUDOERS_DEBUG_AUTH);
 
     /*
      * Create the local context of the DCE principal necessary
@@ -186,7 +186,7 @@ check_dce_status(error_status_t input_status, char *comment)
 {
     int error_stat;
     unsigned char error_string[dce_c_error_string_len];
-    debug_decl(check_dce_status, SUDOERS_DEBUG_AUTH)
+    debug_decl(check_dce_status, SUDOERS_DEBUG_AUTH);
 
     if (input_status == rpc_s_ok)
 	debug_return_int(0);
diff --git a/plugins/sudoers/auth/fwtk.c b/plugins/sudoers/auth/fwtk.c
index c1784b3e3..e37d1af9b 100644
--- a/plugins/sudoers/auth/fwtk.c
+++ b/plugins/sudoers/auth/fwtk.c
@@ -53,7 +53,7 @@ sudo_fwtk_init(struct passwd *pw, sudo_auth *auth)
 {
     static Cfg *confp;			/* Configuration entry struct */
     char resp[128];			/* Response from the server */
-    debug_decl(sudo_fwtk_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_fwtk_init, SUDOERS_DEBUG_AUTH);
 
     if ((confp = cfg_read("sudo")) == (Cfg *)-1) {
 	sudo_warnx(U_("unable to read fwtk config"));
@@ -85,7 +85,7 @@ sudo_fwtk_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_c
     char buf[SUDO_CONV_REPL_MAX + 12];	/* General prupose buffer */
     char resp[128];			/* Response from the server */
     int error;
-    debug_decl(sudo_fwtk_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_fwtk_verify, SUDOERS_DEBUG_AUTH);
 
     /* Send username to authentication server. */
     (void) snprintf(buf, sizeof(buf), "authorize %s 'sudo'", pw->pw_name);
@@ -147,7 +147,7 @@ done:
 int
 sudo_fwtk_cleanup(struct passwd *pw, sudo_auth *auth)
 {
-    debug_decl(sudo_fwtk_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_fwtk_cleanup, SUDOERS_DEBUG_AUTH);
 
     auth_close();
     debug_return_int(AUTH_SUCCESS);
diff --git a/plugins/sudoers/auth/kerb5.c b/plugins/sudoers/auth/kerb5.c
index b298d5ab9..012607730 100644
--- a/plugins/sudoers/auth/kerb5.c
+++ b/plugins/sudoers/auth/kerb5.c
@@ -95,7 +95,7 @@ int
 sudo_krb5_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
 {
     static char	*krb5_prompt;
-    debug_decl(sudo_krb5_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_krb5_init, SUDOERS_DEBUG_AUTH);
 
     if (krb5_prompt == NULL) {
 	krb5_context	sudo_context;
@@ -138,7 +138,7 @@ sudo_krb5_init(struct passwd *pw, sudo_auth *auth)
     krb5_context	sudo_context;
     krb5_error_code 	error;
     char		cache_name[64], *pname = pw->pw_name;
-    debug_decl(sudo_krb5_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_krb5_init, SUDOERS_DEBUG_AUTH);
 
     auth->data = (void *) &sudo_krb5_data; /* Stash all our data here */
 
@@ -190,7 +190,7 @@ sudo_krb5_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_con
     krb5_principal	princ;
     krb5_ccache		ccache;
     krb5_error_code	error;
-    debug_decl(sudo_krb5_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_krb5_verify, SUDOERS_DEBUG_AUTH);
 
     sudo_context = ((sudo_krb5_datap) auth->data)->sudo_context;
     princ = ((sudo_krb5_datap) auth->data)->princ;
@@ -209,7 +209,7 @@ sudo_krb5_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_con
     krb5_ccache		ccache;
     krb5_error_code	error;
     krb5_get_init_creds_opt *opts = NULL;
-    debug_decl(sudo_krb5_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_krb5_verify, SUDOERS_DEBUG_AUTH);
 
     sudo_context = ((sudo_krb5_datap) auth->data)->sudo_context;
     princ = ((sudo_krb5_datap) auth->data)->princ;
@@ -273,7 +273,7 @@ sudo_krb5_cleanup(struct passwd *pw, sudo_auth *auth)
     krb5_context	sudo_context;
     krb5_principal	princ;
     krb5_ccache		ccache;
-    debug_decl(sudo_krb5_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_krb5_cleanup, SUDOERS_DEBUG_AUTH);
 
     sudo_context = ((sudo_krb5_datap) auth->data)->sudo_context;
     princ = ((sudo_krb5_datap) auth->data)->princ;
@@ -305,7 +305,7 @@ verify_krb_v5_tgt(krb5_context sudo_context, krb5_creds *cred, char *auth_name)
     krb5_error_code	error;
     krb5_principal	server;
     krb5_verify_init_creds_opt vopt;
-    debug_decl(verify_krb_v5_tgt, SUDOERS_DEBUG_AUTH)
+    debug_decl(verify_krb_v5_tgt, SUDOERS_DEBUG_AUTH);
 
     /*
      * Get the server principal for the local host.
diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index e5afad9fd..6361871c8 100644
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -103,7 +103,7 @@ static struct conv_filter *conv_filter;
 static void
 conv_filter_init(void)
 {
-    debug_decl(conv_filter_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(conv_filter_init, SUDOERS_DEBUG_AUTH);
 
 #ifdef __hpux__
     /*
@@ -198,7 +198,7 @@ sudo_pam_init2(struct passwd *pw, sudo_auth *auth, bool quiet)
     const char *tty = user_ttypath;
     const char *errstr, *pam_service;
     int rc;
-    debug_decl(sudo_pam_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_init, SUDOERS_DEBUG_AUTH);
 
     /* Stash pointer to last pam status. */
     auth->data = &pam_status;
@@ -292,7 +292,7 @@ sudo_pam_verify(struct passwd *pw, char *prompt, sudo_auth *auth, struct sudo_co
 {
     const char *s;
     int *pam_status = (int *) auth->data;
-    debug_decl(sudo_pam_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_verify, SUDOERS_DEBUG_AUTH);
 
     def_prompt = prompt;	/* for converse */
     getpass_error = false;	/* set by converse if user presses ^C */
@@ -327,7 +327,7 @@ sudo_pam_approval(struct passwd *pw, sudo_auth *auth, bool exempt)
     const char *s;
     int rc, status = AUTH_SUCCESS;
     int *pam_status = (int *) auth->data;
-    debug_decl(sudo_pam_approval, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_approval, SUDOERS_DEBUG_AUTH);
 
     if (def_pam_acct_mgmt) {
 	rc = pam_acct_mgmt(pamh, PAM_SILENT);
@@ -394,7 +394,7 @@ int
 sudo_pam_cleanup(struct passwd *pw, sudo_auth *auth)
 {
     int *pam_status = (int *) auth->data;
-    debug_decl(sudo_pam_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_cleanup, SUDOERS_DEBUG_AUTH);
 
     /* If successful, we can't close the session until sudo_pam_end_session() */
     if (*pam_status != PAM_SUCCESS || auth->end_session == NULL) {
@@ -410,7 +410,7 @@ sudo_pam_begin_session(struct passwd *pw, char **user_envp[], sudo_auth *auth)
     int rc, status = AUTH_SUCCESS;
     int *pam_status = (int *) auth->data;
     const char *errstr;
-    debug_decl(sudo_pam_begin_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_begin_session, SUDOERS_DEBUG_AUTH);
 
     /*
      * If there is no valid user we cannot open a PAM session.
@@ -522,7 +522,7 @@ sudo_pam_end_session(struct passwd *pw, sudo_auth *auth)
 {
     int rc, status = AUTH_SUCCESS;
     const char *errstr;
-    debug_decl(sudo_pam_end_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_pam_end_session, SUDOERS_DEBUG_AUTH);
 
     if (pamh != NULL) {
 	/*
@@ -595,7 +595,7 @@ static bool
 use_pam_prompt(const char *pam_prompt)
 {
     size_t user_len;
-    debug_decl(use_pam_prompt, SUDOERS_DEBUG_AUTH)
+    debug_decl(use_pam_prompt, SUDOERS_DEBUG_AUTH);
 
     /* Always use sudo prompt if passprompt_override is set. */
     if (def_passprompt_override)
@@ -656,7 +656,7 @@ converse(int num_msg, PAM_CONST struct pam_message **msg,
     char *pass;
     int n, type;
     int ret = PAM_SUCCESS;
-    debug_decl(converse, SUDOERS_DEBUG_AUTH)
+    debug_decl(converse, SUDOERS_DEBUG_AUTH);
 
     if (num_msg <= 0 || num_msg > PAM_MAX_NUM_MSG) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c
index a9ce1a296..a0b6fdd65 100644
--- a/plugins/sudoers/auth/passwd.c
+++ b/plugins/sudoers/auth/passwd.c
@@ -48,7 +48,7 @@
 int
 sudo_passwd_init(struct passwd *pw, sudo_auth *auth)
 {
-    debug_decl(sudo_passwd_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_passwd_init, SUDOERS_DEBUG_AUTH);
 
 #ifdef HAVE_SKEYACCESS
     if (skeyaccess(pw, user_tty, NULL, NULL) == 0)
@@ -67,7 +67,7 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
     char *pw_epasswd = auth->data;
     size_t pw_len;
     int matched = 0;
-    debug_decl(sudo_passwd_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_passwd_verify, SUDOERS_DEBUG_AUTH);
 
     /* An empty plain-text password must match an empty encrypted password. */
     if (pass[0] == '\0')
@@ -103,7 +103,7 @@ int
 sudo_passwd_cleanup(struct passwd *pw, sudo_auth *auth)
 {
     char *pw_epasswd = auth->data;
-    debug_decl(sudo_passwd_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_passwd_cleanup, SUDOERS_DEBUG_AUTH);
 
     if (pw_epasswd != NULL) {
 	memset_s(pw_epasswd, SUDO_CONV_REPL_MAX, 0, strlen(pw_epasswd));
diff --git a/plugins/sudoers/auth/rfc1938.c b/plugins/sudoers/auth/rfc1938.c
index e86669119..81f39d595 100644
--- a/plugins/sudoers/auth/rfc1938.c
+++ b/plugins/sudoers/auth/rfc1938.c
@@ -69,7 +69,7 @@ sudo_rfc1938_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
     static char *orig_prompt = NULL, *new_prompt = NULL;
     static size_t op_len, np_size;
     static struct RFC1938 rfc1938;
-    debug_decl(sudo_rfc1938_setup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_rfc1938_setup, SUDOERS_DEBUG_AUTH);
 
     /* Stash a pointer to the rfc1938 struct if we have not initialized */
     if (!auth->data)
@@ -133,7 +133,7 @@ sudo_rfc1938_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
 int
 sudo_rfc1938_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback)
 {
-    debug_decl(sudo_rfc1938_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_rfc1938_verify, SUDOERS_DEBUG_AUTH);
 
     if (rfc1938verify((struct RFC1938 *) auth->data, pass) == 0)
 	debug_return_int(AUTH_SUCCESS);
diff --git a/plugins/sudoers/auth/secureware.c b/plugins/sudoers/auth/secureware.c
index fad78fcad..d25734f7d 100644
--- a/plugins/sudoers/auth/secureware.c
+++ b/plugins/sudoers/auth/secureware.c
@@ -58,7 +58,7 @@ extern int crypt_type;
 int
 sudo_secureware_init(struct passwd *pw, sudo_auth *auth)
 {
-    debug_decl(sudo_secureware_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_secureware_init, SUDOERS_DEBUG_AUTH);
 
 #ifdef __alpha
     if (crypt_type == INT_MAX)
@@ -76,7 +76,7 @@ sudo_secureware_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct su
 {
     char *pw_epasswd = auth->data;
     char *epass = NULL;
-    debug_decl(sudo_secureware_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_secureware_verify, SUDOERS_DEBUG_AUTH);
 
     /* An empty plain-text password must match an empty encrypted password. */
     if (pass[0] == '\0')
@@ -104,7 +104,7 @@ int
 sudo_secureware_cleanup(struct passwd *pw, sudo_auth *auth)
 {
     char *pw_epasswd = auth->data;
-    debug_decl(sudo_secureware_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_secureware_cleanup, SUDOERS_DEBUG_AUTH);
 
     if (pw_epasswd != NULL) {
 	memset_s(pw_epasswd, SUDO_CONV_REPL_MAX, 0, strlen(pw_epasswd));
diff --git a/plugins/sudoers/auth/securid5.c b/plugins/sudoers/auth/securid5.c
index 9f1ab3b16..da63eaef9 100644
--- a/plugins/sudoers/auth/securid5.c
+++ b/plugins/sudoers/auth/securid5.c
@@ -66,7 +66,7 @@ int
 sudo_securid_init(struct passwd *pw, sudo_auth *auth)
 {
     static SDI_HANDLE sd_dat;			/* SecurID handle */
-    debug_decl(sudo_securid_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_securid_init, SUDOERS_DEBUG_AUTH);
 
     auth->data = (void *) &sd_dat;		/* For method-specific data */
 
@@ -96,7 +96,7 @@ sudo_securid_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
 {
     SDI_HANDLE *sd = (SDI_HANDLE *) auth->data;
     int retval;
-    debug_decl(sudo_securid_setup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_securid_setup, SUDOERS_DEBUG_AUTH);
 
     /* Re-initialize SecurID every time. */
     if (SD_Init(sd) != ACM_OK) {
@@ -147,7 +147,7 @@ sudo_securid_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_
 {
     SDI_HANDLE *sd = (SDI_HANDLE *) auth->data;
     int ret;
-    debug_decl(sudo_securid_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_securid_verify, SUDOERS_DEBUG_AUTH);
 
     pass = auth_getpass("Enter your PASSCODE: ", SUDO_CONV_PROMPT_ECHO_OFF,
 	callback);
diff --git a/plugins/sudoers/auth/sia.c b/plugins/sudoers/auth/sia.c
index 8f54c49ee..1073ebcfa 100644
--- a/plugins/sudoers/auth/sia.c
+++ b/plugins/sudoers/auth/sia.c
@@ -55,7 +55,7 @@ sudo_sia_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
 {
     SIAENTITY *siah;
     int i;
-    debug_decl(sudo_sia_setup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_sia_setup, SUDOERS_DEBUG_AUTH);
 
     /* Rebuild argv for sia_ses_init() */
     sudo_argc = NewArgc + 1;
@@ -86,7 +86,7 @@ sudo_sia_verify(struct passwd *pw, char *prompt, sudo_auth *auth,
     SIAENTITY *siah = auth->data;
     char *pass;
     int rc;
-    debug_decl(sudo_sia_verify, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_sia_verify, SUDOERS_DEBUG_AUTH);
 
     /* Get password, return AUTH_INTR if we got ^C */
     pass = auth_getpass(prompt, SUDO_CONV_PROMPT_ECHO_OFF, callback);
@@ -109,7 +109,7 @@ int
 sudo_sia_cleanup(struct passwd *pw, sudo_auth *auth)
 {
     SIAENTITY *siah = auth->data;
-    debug_decl(sudo_sia_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_sia_cleanup, SUDOERS_DEBUG_AUTH);
 
     (void) sia_ses_release(&siah);
     auth->data = NULL;
@@ -122,7 +122,7 @@ sudo_sia_begin_session(struct passwd *pw, char **user_envp[], sudo_auth *auth)
 {
     SIAENTITY *siah;
     int status = AUTH_FATAL;
-    debug_decl(sudo_sia_begin_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_sia_begin_session, SUDOERS_DEBUG_AUTH);
 
     /* Re-init sia for the target user's session. */
     if (sia_ses_init(&siah, NewArgc, NewArgv, NULL, pw->pw_name, user_ttypath, 0, NULL) != SIASUCCESS) {
diff --git a/plugins/sudoers/auth/sudo_auth.c b/plugins/sudoers/auth/sudo_auth.c
index bae41a20d..e22c3d174 100644
--- a/plugins/sudoers/auth/sudo_auth.c
+++ b/plugins/sudoers/auth/sudo_auth.c
@@ -107,7 +107,7 @@ sudo_auth_init(struct passwd *pw)
 {
     sudo_auth *auth;
     int status = AUTH_SUCCESS;
-    debug_decl(sudo_auth_init, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_init, SUDOERS_DEBUG_AUTH);
 
     if (auth_switch[0].name == NULL)
 	debug_return_int(0);
@@ -178,7 +178,7 @@ int
 sudo_auth_approval(struct passwd *pw, int validated, bool exempt)
 {
     sudo_auth *auth;
-    debug_decl(sudo_auth_approval, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_approval, SUDOERS_DEBUG_AUTH);
 
     /* Call approval routines. */
     for (auth = auth_switch; auth->name; auth++) {
@@ -202,7 +202,7 @@ int
 sudo_auth_cleanup(struct passwd *pw)
 {
     sudo_auth *auth;
-    debug_decl(sudo_auth_cleanup, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_cleanup, SUDOERS_DEBUG_AUTH);
 
     /* Call cleanup routines. */
     for (auth = auth_switch; auth->name; auth++) {
@@ -221,7 +221,7 @@ static void
 pass_warn(void)
 {
     const char *warning = def_badpass_message;
-    debug_decl(pass_warn, SUDOERS_DEBUG_AUTH)
+    debug_decl(pass_warn, SUDOERS_DEBUG_AUTH);
 
 #ifdef INSULT
     if (def_insults)
@@ -254,7 +254,7 @@ verify_user(struct passwd *pw, char *prompt, int validated,
     sudo_auth *auth;
     sigset_t mask, omask;
     struct sigaction sa, saved_sigtstp;
-    debug_decl(verify_user, SUDOERS_DEBUG_AUTH)
+    debug_decl(verify_user, SUDOERS_DEBUG_AUTH);
 
     /* Make sure we have at least one auth method. */
     if (auth_switch[0].name == NULL) {
@@ -374,7 +374,7 @@ int
 sudo_auth_begin_session(struct passwd *pw, char **user_env[])
 {
     sudo_auth *auth;
-    debug_decl(sudo_auth_begin_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_begin_session, SUDOERS_DEBUG_AUTH);
 
     for (auth = auth_switch; auth->name; auth++) {
 	if (auth->begin_session && !IS_DISABLED(auth)) {
@@ -393,7 +393,7 @@ sudo_auth_needs_end_session(void)
 {
     sudo_auth *auth;
     bool needed = false;
-    debug_decl(sudo_auth_needs_end_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_needs_end_session, SUDOERS_DEBUG_AUTH);
 
     for (auth = auth_switch; auth->name; auth++) {
 	if (auth->end_session && !IS_DISABLED(auth)) {
@@ -413,7 +413,7 @@ sudo_auth_end_session(struct passwd *pw)
 {
     sudo_auth *auth;
     int status;
-    debug_decl(sudo_auth_end_session, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_auth_end_session, SUDOERS_DEBUG_AUTH);
 
     for (auth = auth_switch; auth->name; auth++) {
 	if (auth->end_session && !IS_DISABLED(auth)) {
@@ -438,7 +438,7 @@ auth_getpass(const char *prompt, int type, struct sudo_conv_callback *callback)
     struct sudo_conv_message msg;
     struct sudo_conv_reply repl;
     sigset_t mask, omask;
-    debug_decl(auth_getpass, SUDOERS_DEBUG_AUTH)
+    debug_decl(auth_getpass, SUDOERS_DEBUG_AUTH);
 
     /* Mask user input if pwfeedback set and echo is off. */
     if (type == SUDO_CONV_PROMPT_ECHO_OFF && def_pwfeedback)
@@ -474,7 +474,7 @@ void
 dump_auth_methods(void)
 {
     sudo_auth *auth;
-    debug_decl(dump_auth_methods, SUDOERS_DEBUG_AUTH)
+    debug_decl(dump_auth_methods, SUDOERS_DEBUG_AUTH);
 
     sudo_printf(SUDO_CONV_INFO_MSG, _("Authentication methods:"));
     for (auth = auth_switch; auth->name; auth++)
diff --git a/plugins/sudoers/base64.c b/plugins/sudoers/base64.c
index 3d86ae68f..1418681d3 100644
--- a/plugins/sudoers/base64.c
+++ b/plugins/sudoers/base64.c
@@ -69,7 +69,7 @@ base64_decode(const char *in, unsigned char *out, size_t out_size)
     unsigned char *out_end = out + out_size;
     const unsigned char *out0 = out;
     unsigned int rem, v;
-    debug_decl(base64_decode, SUDOERS_DEBUG_MATCH)
+    debug_decl(base64_decode, SUDOERS_DEBUG_MATCH);
 
     for (v = 0, rem = 0; *in != '\0' && *in != '='; in++) {
 	unsigned char ch = base64dec_tab[(unsigned char)*in];
@@ -100,7 +100,7 @@ base64_encode(const unsigned char *in, size_t in_len, char *out, size_t out_len)
 {
     size_t ii, io;
     unsigned int rem, v;
-    debug_decl(base64_encode, SUDOERS_DEBUG_MATCH)
+    debug_decl(base64_encode, SUDOERS_DEBUG_MATCH);
 
     for (io = 0, ii = 0, v = 0, rem = 0; ii < in_len; ii++) {
 	unsigned char ch = in[ii];
diff --git a/plugins/sudoers/boottime.c b/plugins/sudoers/boottime.c
index a8b0ce6cf..9e67911d3 100644
--- a/plugins/sudoers/boottime.c
+++ b/plugins/sudoers/boottime.c
@@ -69,7 +69,7 @@ get_boottime(struct timespec *ts)
     long long llval;
     ssize_t len;
     FILE *fp;
-    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL);
 
     /* read btime from /proc/stat */
     fp = fopen("/proc/stat", "r");
@@ -107,7 +107,7 @@ get_boottime(struct timespec *ts)
     size_t size;
     int mib[2];
     struct timeval tv;
-    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL);
 
     mib[0] = CTL_KERN;
     mib[1] = KERN_BOOTTIME;
@@ -130,7 +130,7 @@ bool
 get_boottime(struct timespec *ts)
 {
     struct utmpx *ut, key;
-    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL);
 
     memset(&key, 0, sizeof(key));
     key.ut_type = BOOT_TIME;
@@ -151,7 +151,7 @@ bool
 get_boottime(struct timespec *ts)
 {
     struct utmp *ut, key;
-    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL);
 
     memset(&key, 0, sizeof(key));
     key.ut_type = BOOT_TIME;
@@ -171,7 +171,7 @@ get_boottime(struct timespec *ts)
 bool
 get_boottime(struct timespec *ts)
 {
-    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_boottime, SUDOERS_DEBUG_UTIL);
     debug_return_bool(false);
 }
 #endif
diff --git a/plugins/sudoers/bsm_audit.c b/plugins/sudoers/bsm_audit.c
index bbb8525ed..3c09250dc 100644
--- a/plugins/sudoers/bsm_audit.c
+++ b/plugins/sudoers/bsm_audit.c
@@ -64,7 +64,7 @@ audit_sudo_selected(int sorf)
 	auditinfo_addr_t ainfo_addr;
 	struct au_mask *mask;
 	int rc;
-	debug_decl(audit_sudo_selected, SUDOERS_DEBUG_AUDIT)
+	debug_decl(audit_sudo_selected, SUDOERS_DEBUG_AUDIT);
 
 	if (getaudit_addr(&ainfo_addr, sizeof(ainfo_addr)) < 0) {
 #ifdef BSM_AUDIT_COMPAT
@@ -114,7 +114,7 @@ bsm_audit_success(char *exec_args[])
 	long au_cond;
 	int aufd, selected;
 	pid_t pid;
-	debug_decl(bsm_audit_success, SUDOERS_DEBUG_AUDIT)
+	debug_decl(bsm_audit_success, SUDOERS_DEBUG_AUDIT);
 
 	/*
 	 * If we are not auditing, don't cut an audit record; just return.
@@ -206,7 +206,7 @@ bsm_audit_failure(char *exec_args[], char const *const fmt, va_list ap)
 	au_id_t auid;
 	pid_t pid;
 	int aufd;
-	debug_decl(bsm_audit_success, SUDOERS_DEBUG_AUDIT)
+	debug_decl(bsm_audit_success, SUDOERS_DEBUG_AUDIT);
 
 	/*
 	 * If we are not auditing, don't cut an audit record; just return.
diff --git a/plugins/sudoers/check.c b/plugins/sudoers/check.c
index 7c8226c03..72e87eef6 100644
--- a/plugins/sudoers/check.c
+++ b/plugins/sudoers/check.c
@@ -96,7 +96,7 @@ check_user_interactive(int validated, int mode, struct getpass_closure *closure)
     int ret = -1;
     char *prompt;
     bool lectured;
-    debug_decl(check_user_interactive, SUDOERS_DEBUG_AUTH)
+    debug_decl(check_user_interactive, SUDOERS_DEBUG_AUTH);
 
     /* Open, lock and read time stamp file if we are using it. */
     if (!ISSET(mode, MODE_IGNORE_TICKET)) {
@@ -167,7 +167,7 @@ check_user(int validated, int mode)
     struct getpass_closure closure = { TS_ERROR };
     int ret = -1;
     bool exempt = false;
-    debug_decl(check_user, SUDOERS_DEBUG_AUTH)
+    debug_decl(check_user, SUDOERS_DEBUG_AUTH);
 
     /*
      * Init authentication system regardless of whether we need a password.
@@ -242,7 +242,7 @@ display_lecture(int status)
     ssize_t nread;
     struct sudo_conv_message msg;
     struct sudo_conv_reply repl;
-    debug_decl(lecture, SUDOERS_DEBUG_AUTH)
+    debug_decl(lecture, SUDOERS_DEBUG_AUTH);
 
     if (def_lecture == never ||
 	(def_lecture == once && already_lectured(status)))
@@ -279,7 +279,7 @@ bool
 user_is_exempt(void)
 {
     bool ret = false;
-    debug_decl(user_is_exempt, SUDOERS_DEBUG_AUTH)
+    debug_decl(user_is_exempt, SUDOERS_DEBUG_AUTH);
 
     if (def_exempt_group)
 	ret = user_in_group(sudo_user.pw, def_exempt_group);
@@ -295,7 +295,7 @@ static struct passwd *
 get_authpw(int mode)
 {
     struct passwd *pw = NULL;
-    debug_decl(get_authpw, SUDOERS_DEBUG_AUTH)
+    debug_decl(get_authpw, SUDOERS_DEBUG_AUTH);
 
     if (ISSET(mode, (MODE_CHECK|MODE_LIST))) {
 	/* In list mode we always prompt for the user's password. */
@@ -336,7 +336,7 @@ bool
 check_user_shell(const struct passwd *pw)
 {
     const char *shell;
-    debug_decl(check_user_shell, SUDOERS_DEBUG_AUTH)
+    debug_decl(check_user_shell, SUDOERS_DEBUG_AUTH);
 
     if (!def_runas_check_shell)
 	debug_return_bool(true);
diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
index 9dad67707..7d7be2ca0 100644
--- a/plugins/sudoers/cvtsudoers.c
+++ b/plugins/sudoers/cvtsudoers.c
@@ -110,7 +110,7 @@ main(int argc, char *argv[])
     const char *output_file = "-";
     const char *conf_file = _PATH_CVTSUDOERS_CONF;
     const char *errstr;
-    debug_decl(main, SUDOERS_DEBUG_MAIN)
+    debug_decl(main, SUDOERS_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     {
@@ -404,7 +404,7 @@ cvtsudoers_parse_keyword(const char *conf_file, const char *keyword,
 {
     struct cvtsudoers_conf_table *cur;
     const char *errstr;
-    debug_decl(sudo_ldap_parse_keyword, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudo_ldap_parse_keyword, SUDOERS_DEBUG_UTIL);
 
     /* Look up keyword in config tables */
     for (cur = table; cur->conf_str != NULL; cur++) {
@@ -449,7 +449,7 @@ cvtsudoers_conf_read(const char *conf_file)
     char *line = NULL;
     size_t linesize = 0;
     FILE *fp;
-    debug_decl(cvtsudoers_conf_read, SUDOERS_DEBUG_UTIL)
+    debug_decl(cvtsudoers_conf_read, SUDOERS_DEBUG_UTIL);
 
     if ((fp = fopen(conf_file, "r")) == NULL)
 	debug_return_ptr(&cvtsudoers_config);
@@ -488,7 +488,7 @@ cvtsudoers_conf_read(const char *conf_file)
 static void
 cvtsudoers_conf_free(struct cvtsudoers_config *conf)
 {
-    debug_decl(cvtsudoers_conf_free, SUDOERS_DEBUG_UTIL)
+    debug_decl(cvtsudoers_conf_free, SUDOERS_DEBUG_UTIL);
 
     if (conf != NULL) {
 	free(conf->sudoers_base);
@@ -507,7 +507,7 @@ cvtsudoers_parse_defaults(char *expression)
 {
     char *last, *cp = expression;
     int flags = 0;
-    debug_decl(cvtsudoers_parse_defaults, SUDOERS_DEBUG_UTIL)
+    debug_decl(cvtsudoers_parse_defaults, SUDOERS_DEBUG_UTIL);
 
     for ((cp = strtok_r(cp, ",", &last)); cp != NULL; (cp = strtok_r(NULL, ",", &last))) {
 	if (strcasecmp(cp, "all") == 0) {
@@ -536,7 +536,7 @@ cvtsudoers_parse_suppression(char *expression)
 {
     char *last, *cp = expression;
     int flags = 0;
-    debug_decl(cvtsudoers_parse_suppression, SUDOERS_DEBUG_UTIL)
+    debug_decl(cvtsudoers_parse_suppression, SUDOERS_DEBUG_UTIL);
 
     for ((cp = strtok_r(cp, ",", &last)); cp != NULL; (cp = strtok_r(NULL, ",", &last))) {
 	if (strcasecmp(cp, "defaults") == 0) {
@@ -558,7 +558,7 @@ static bool
 cvtsudoers_parse_filter(char *expression)
 {
     char *last, *cp = expression;
-    debug_decl(cvtsudoers_parse_filter, SUDOERS_DEBUG_UTIL)
+    debug_decl(cvtsudoers_parse_filter, SUDOERS_DEBUG_UTIL);
 
     if (filters == NULL) {
 	if ((filters = malloc(sizeof(*filters))) == NULL) {
@@ -614,7 +614,7 @@ parse_ldif(struct sudoers_parse_tree *parse_tree, const char *input_file,
     struct cvtsudoers_config *conf)
 {
     FILE *fp = stdin;
-    debug_decl(parse_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(parse_ldif, SUDOERS_DEBUG_UTIL);
 
     /* Open LDIF file and parse it. */
     if (strcmp(input_file, "-") != 0) {
@@ -629,7 +629,7 @@ parse_ldif(struct sudoers_parse_tree *parse_tree, const char *input_file,
 static bool
 parse_sudoers(const char *input_file, struct cvtsudoers_config *conf)
 {
-    debug_decl(parse_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(parse_sudoers, SUDOERS_DEBUG_UTIL);
 
     /* Open sudoers file and parse it. */
     if (strcmp(input_file, "-") == 0) {
@@ -669,7 +669,7 @@ userlist_matches_filter(struct sudoers_parse_tree *parse_tree,
     struct sudoers_string *s;
     struct member *m, *next;
     bool ret = false;
-    debug_decl(userlist_matches_filter, SUDOERS_DEBUG_UTIL)
+    debug_decl(userlist_matches_filter, SUDOERS_DEBUG_UTIL);
 
     if (filters == NULL ||
 	(STAILQ_EMPTY(&filters->users) && STAILQ_EMPTY(&filters->groups)))
@@ -747,7 +747,7 @@ hostlist_matches_filter(struct sudoers_parse_tree *parse_tree,
     bool ret = false;
     char **shosts;
     int n = 0;
-    debug_decl(hostlist_matches_filter, SUDOERS_DEBUG_UTIL)
+    debug_decl(hostlist_matches_filter, SUDOERS_DEBUG_UTIL);
 
     if (filters == NULL || STAILQ_EMPTY(&filters->hosts))
 	debug_return_bool(true);
@@ -827,7 +827,7 @@ print_defaults_sudoers(struct sudoers_parse_tree *parse_tree,
     struct sudo_lbuf *lbuf, bool expand_aliases)
 {
     struct defaults *def, *next;
-    debug_decl(print_defaults_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_defaults_sudoers, SUDOERS_DEBUG_UTIL);
 
     TAILQ_FOREACH_SAFE(def, &parse_tree->defaults, entries, next) {
 	sudoers_format_default_line(lbuf, parse_tree, def, &next,
@@ -843,7 +843,7 @@ print_alias_sudoers(struct sudoers_parse_tree *parse_tree, struct alias *a,
 {
     struct sudo_lbuf *lbuf = v;
     struct member *m;
-    debug_decl(print_alias_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_alias_sudoers, SUDOERS_DEBUG_UTIL);
 
     sudo_lbuf_append(lbuf, "%s %s = ", alias_type_to_string(a->type),
 	a->name);
@@ -864,7 +864,7 @@ static bool
 print_aliases_sudoers(struct sudoers_parse_tree *parse_tree,
     struct sudo_lbuf *lbuf)
 {
-    debug_decl(print_aliases_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_aliases_sudoers, SUDOERS_DEBUG_UTIL);
 
     alias_apply(parse_tree, print_alias_sudoers, lbuf);
 
@@ -888,7 +888,7 @@ filter_userspecs(struct sudoers_parse_tree *parse_tree,
 {
     struct userspec *us, *next_us;
     struct privilege *priv, *next_priv;
-    debug_decl(filter_userspecs, SUDOERS_DEBUG_UTIL)
+    debug_decl(filter_userspecs, SUDOERS_DEBUG_UTIL);
 
     if (filters == NULL)
 	debug_return;
@@ -931,7 +931,7 @@ alias_matches(struct sudoers_parse_tree *parse_tree, const char *name,
     struct alias *a;
     struct member *m;
     bool ret = false;
-    debug_decl(alias_matches, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_matches, SUDOERS_DEBUG_ALIAS);
 
     if (strcmp(name, alias_name) == 0)
 	debug_return_bool(true);
@@ -967,7 +967,7 @@ alias_used_by_userspecs(struct sudoers_parse_tree *parse_tree,
     struct cmndspec *cs, *cs_next;
     struct member *m, *m_next;
     struct member *am, *am_next;
-    debug_decl(alias_used_by_userspecs, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_used_by_userspecs, SUDOERS_DEBUG_ALIAS);
 
     /* Iterate over the policy, checking for aliases. */
     TAILQ_FOREACH_SAFE(us, &parse_tree->userspecs, entries, us_next) {
@@ -1053,7 +1053,7 @@ filter_defaults(struct sudoers_parse_tree *parse_tree,
     struct member *m, *m_next;
     struct alias *a;
     int alias_type;
-    debug_decl(filter_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(filter_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     if (filters == NULL && conf->defaults == CVT_DEFAULTS_ALL)
 	debug_return;
@@ -1172,7 +1172,7 @@ static void
 alias_remove_unused(struct sudoers_parse_tree *parse_tree)
 {
     struct rbtree *used_aliases;
-    debug_decl(alias_remove_unused, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_remove_unused, SUDOERS_DEBUG_ALIAS);
 
     used_aliases = alloc_aliases();
     if (used_aliases == NULL)
@@ -1220,7 +1220,7 @@ static void
 alias_prune(struct sudoers_parse_tree *parse_tree,
     struct cvtsudoers_config *conf)
 {
-    debug_decl(alias_prune, SUDOERS_DEBUG_ALIAS)
+    debug_decl(alias_prune, SUDOERS_DEBUG_ALIAS);
 
     alias_apply(parse_tree, alias_prune_helper, conf);
 
@@ -1236,7 +1236,7 @@ convert_sudoers_sudoers(struct sudoers_parse_tree *parse_tree,
 {
     bool ret = true;
     struct sudo_lbuf lbuf;
-    debug_decl(convert_sudoers_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(convert_sudoers_sudoers, SUDOERS_DEBUG_UTIL);
 
     if (strcmp(output_file, "-") == 0) {
 	output_fp = stdout;
diff --git a/plugins/sudoers/cvtsudoers_json.c b/plugins/sudoers/cvtsudoers_json.c
index cf1186dcd..9485d45d9 100644
--- a/plugins/sudoers/cvtsudoers_json.c
+++ b/plugins/sudoers/cvtsudoers_json.c
@@ -160,7 +160,7 @@ static void
 print_pair_json(FILE *fp, const char *pre, const char *name,
     const struct json_value *value, const char *post, int indent)
 {
-    debug_decl(print_pair_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_pair_json, SUDOERS_DEBUG_UTIL);
 
     print_indent(fp, indent);
 
@@ -213,7 +213,7 @@ static void
 printstr_json(FILE *fp, const char *pre, const char *str, const char *post,
     int indent)
 {
-    debug_decl(printstr_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(printstr_json, SUDOERS_DEBUG_UTIL);
 
     print_indent(fp, indent);
     if (pre != NULL)
@@ -237,7 +237,7 @@ print_command_json(FILE *fp, const char *name, int type, bool negated, int inden
     struct sudo_command *c = (struct sudo_command *)name;
     struct json_value value;
     const char *digest_name;
-    debug_decl(print_command_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_command_json, SUDOERS_DEBUG_UTIL);
 
     printstr_json(fp, "{", NULL, NULL, indent);
     if (negated || c->digest != NULL) {
@@ -346,7 +346,7 @@ print_member_json_int(FILE *fp, struct sudoers_parse_tree *parse_tree,
     const char *errstr;
     int alias_type = UNSPEC;
     id_t id;
-    debug_decl(print_member_json_int, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_member_json_int, SUDOERS_DEBUG_UTIL);
 
     /* Most of the time we print a string. */
     value.type = JSON_STRING;
@@ -534,7 +534,7 @@ print_alias_json(struct sudoers_parse_tree *parse_tree, struct alias *a, void *v
 {
     struct json_alias_closure *closure = v;
     struct member *m;
-    debug_decl(print_alias_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_alias_json, SUDOERS_DEBUG_UTIL);
 
     if (a->type != closure->alias_type)
 	debug_return_int(0);
@@ -568,7 +568,7 @@ print_binding_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct member_list *binding, int type, int indent, bool expand_aliases)
 {
     struct member *m;
-    debug_decl(print_binding_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_binding_json, SUDOERS_DEBUG_UTIL);
 
     if (TAILQ_EMPTY(binding))
 	debug_return;
@@ -596,7 +596,7 @@ print_defaults_list_json(FILE *fp, struct defaults *def, int indent)
 {
     char savech, *start, *end = def->val;
     struct json_value value;
-    debug_decl(print_defaults_list_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_defaults_list_json, SUDOERS_DEBUG_UTIL);
 
     fprintf(fp, "%*s{\n", indent, "");
     indent += 4;
@@ -670,7 +670,7 @@ print_defaults_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct json_value value;
     struct defaults *def, *next;
     int type;
-    debug_decl(print_defaults_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_defaults_json, SUDOERS_DEBUG_UTIL);
 
     if (TAILQ_EMPTY(&parse_tree->defaults))
 	debug_return_bool(need_comma);
@@ -749,7 +749,7 @@ print_aliases_by_type_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     int alias_type, const char *title, int indent, bool need_comma)
 {
     struct json_alias_closure closure;
-    debug_decl(print_aliases_by_type_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_aliases_by_type_json, SUDOERS_DEBUG_UTIL);
 
     closure.fp = fp;
     closure.indent = indent;
@@ -777,7 +777,7 @@ static bool
 print_aliases_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     int indent, bool need_comma)
 {
-    debug_decl(print_aliases_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_aliases_json, SUDOERS_DEBUG_UTIL);
 
     need_comma = print_aliases_by_type_json(fp, parse_tree, USERALIAS,
 	"User_Aliases", indent, need_comma);
@@ -808,7 +808,7 @@ print_cmndspec_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct tm *tp;
     bool last_one;
     char timebuf[sizeof("20120727121554Z")];
-    debug_decl(print_cmndspec_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_cmndspec_json, SUDOERS_DEBUG_UTIL);
 
     /* Open Cmnd_Spec object. */
     fprintf(fp, "%*s{\n", indent, "");
@@ -1041,7 +1041,7 @@ print_userspec_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct privilege *priv;
     struct member *m;
     struct cmndspec *cs, *next;
-    debug_decl(print_userspec_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_userspec_json, SUDOERS_DEBUG_UTIL);
 
     /*
      * Each userspec struct may contain multiple privileges for
@@ -1097,7 +1097,7 @@ print_userspecs_json(FILE *fp, struct sudoers_parse_tree *parse_tree,
     int indent, bool expand_aliases, bool need_comma)
 {
     struct userspec *us;
-    debug_decl(print_userspecs_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_userspecs_json, SUDOERS_DEBUG_UTIL);
 
     if (TAILQ_EMPTY(&parse_tree->userspecs))
 	debug_return_bool(need_comma);
@@ -1123,7 +1123,7 @@ convert_sudoers_json(struct sudoers_parse_tree *parse_tree,
     bool ret = true, need_comma = false;
     const int indent = 4;
     FILE *output_fp = stdout;
-    debug_decl(convert_sudoers_json, SUDOERS_DEBUG_UTIL)
+    debug_decl(convert_sudoers_json, SUDOERS_DEBUG_UTIL);
 
     if (strcmp(output_file, "-") != 0) {
 	if ((output_fp = fopen(output_file, "w")) == NULL)
diff --git a/plugins/sudoers/cvtsudoers_ldif.c b/plugins/sudoers/cvtsudoers_ldif.c
index efdce0ed9..cbcdc2d72 100644
--- a/plugins/sudoers/cvtsudoers_ldif.c
+++ b/plugins/sudoers/cvtsudoers_ldif.c
@@ -71,7 +71,7 @@ static bool
 safe_string(const char *str)
 {
     unsigned int ch = *str++;
-    debug_decl(safe_string, SUDOERS_DEBUG_UTIL)
+    debug_decl(safe_string, SUDOERS_DEBUG_UTIL);
 
     /* Initial char must be <= 127 and not LF, CR, SPACE, ':', '<' */
     switch (ch) {
@@ -103,7 +103,7 @@ print_attribute_ldif(FILE *fp, const char *name, const char *value)
     const unsigned char *uvalue = (unsigned char *)value;
     char *encoded = NULL;
     size_t esize;
-    debug_decl(print_attribute_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_attribute_ldif, SUDOERS_DEBUG_UTIL);
 
     if (!safe_string(value)) {
 	const size_t vlen = strlen(value);
@@ -134,7 +134,7 @@ print_options_ldif(FILE *fp, struct defaults_list *options)
     struct defaults *opt;
     char *attr_val;
     int len;
-    debug_decl(print_options_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_options_ldif, SUDOERS_DEBUG_UTIL);
 
     TAILQ_FOREACH(opt, options, entries) {
 	if (opt->type != DEFAULTS)
@@ -171,7 +171,7 @@ print_global_defaults_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct sudo_lbuf lbuf;
     struct defaults *opt;
     char *dn;
-    debug_decl(print_global_defaults_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_global_defaults_ldif, SUDOERS_DEBUG_UTIL);
 
     sudo_lbuf_init(&lbuf, NULL, 0, NULL, 80);
 
@@ -222,7 +222,7 @@ print_member_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree, char *name,
     struct sudo_command *c;
     char *attr_val;
     int len;
-    debug_decl(print_member_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_member_ldif, SUDOERS_DEBUG_UTIL);
 
     switch (type) {
     case ALL:
@@ -284,7 +284,7 @@ print_cmndspec_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct tm *tp;
     bool last_one;
     char timebuf[sizeof("20120727121554Z")];
-    debug_decl(print_cmndspec_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_cmndspec_ldif, SUDOERS_DEBUG_UTIL);
 
     /* Print runasuserlist as sudoRunAsUser attributes */
     if (cs->runasuserlist != NULL) {
@@ -471,7 +471,7 @@ user_to_cn(const char *user)
     const char *src;
     char *cn, *dst;
     size_t size;
-    debug_decl(user_to_cn, SUDOERS_DEBUG_UTIL)
+    debug_decl(user_to_cn, SUDOERS_DEBUG_UTIL);
 
     /* Allocate as much as we could possibly need. */
     size = (2 * strlen(user)) + 64 + 1;
@@ -547,7 +547,7 @@ print_userspec_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct privilege *priv;
     struct member *m;
     struct cmndspec *cs, *next;
-    debug_decl(print_userspec_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_userspec_ldif, SUDOERS_DEBUG_UTIL);
 
     /*
      * Each userspec struct may contain multiple privileges for
@@ -614,7 +614,7 @@ print_userspecs_ldif(FILE *fp, struct sudoers_parse_tree *parse_tree,
     struct cvtsudoers_config *conf)
 {
     struct userspec *us;
-    debug_decl(print_userspecs_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_userspecs_ldif, SUDOERS_DEBUG_UTIL);
  
     TAILQ_FOREACH(us, &parse_tree->userspecs, entries) {
 	if (!print_userspec_ldif(fp, parse_tree, us, conf))
@@ -632,7 +632,7 @@ convert_sudoers_ldif(struct sudoers_parse_tree *parse_tree,
 {
     bool ret = true;
     FILE *output_fp = stdout;
-    debug_decl(convert_sudoers_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(convert_sudoers_ldif, SUDOERS_DEBUG_UTIL);
 
     if (conf->sudoers_base == NULL) {
 	sudo_fatalx(U_("the SUDOERS_BASE environment variable is not set and the -b option was not specified."));
diff --git a/plugins/sudoers/cvtsudoers_pwutil.c b/plugins/sudoers/cvtsudoers_pwutil.c
index 459ee6e09..8308f28a9 100644
--- a/plugins/sudoers/cvtsudoers_pwutil.c
+++ b/plugins/sudoers/cvtsudoers_pwutil.c
@@ -88,7 +88,7 @@ cvtsudoers_make_pwitem(uid_t uid, const char *name)
     struct cache_item_pw *pwitem;
     struct passwd pw, *newpw;
     struct sudoers_string *s = NULL;
-    debug_decl(cvtsudoers_make_pwitem, SUDOERS_DEBUG_NSS)
+    debug_decl(cvtsudoers_make_pwitem, SUDOERS_DEBUG_NSS);
 
     /* Look up name or uid in filter list. */
     if (name != NULL) {
@@ -195,7 +195,7 @@ cvtsudoers_make_gritem(gid_t gid, const char *name)
     struct cache_item_gr *gritem;
     struct group gr, *newgr;
     struct sudoers_string *s = NULL;
-    debug_decl(cvtsudoers_make_gritem, SUDOERS_DEBUG_NSS)
+    debug_decl(cvtsudoers_make_gritem, SUDOERS_DEBUG_NSS);
 
     /* Look up name or gid in filter list. */
     if (name != NULL) {
@@ -307,7 +307,7 @@ cvtsudoers_make_gidlist_item(const struct passwd *pw, char * const *unused1,
     struct gid_list *gidlist;
     GETGROUPS_T *gids = NULL;
     int i, ngids = 0;
-    debug_decl(cvtsudoers_make_gidlist_item, SUDOERS_DEBUG_NSS)
+    debug_decl(cvtsudoers_make_gidlist_item, SUDOERS_DEBUG_NSS);
 
     /*
      * There's only a single gid list.
@@ -404,7 +404,7 @@ cvtsudoers_make_grlist_item(const struct passwd *pw, char * const *unused1)
     struct sudoers_string *s;
     struct group_list *grlist;
     int groupname_len;
-    debug_decl(cvtsudoers_make_grlist_item, SUDOERS_DEBUG_NSS)
+    debug_decl(cvtsudoers_make_grlist_item, SUDOERS_DEBUG_NSS);
 
     /*
      * There's only a single group list.
diff --git a/plugins/sudoers/defaults.c b/plugins/sudoers/defaults.c
index 1af8cd307..a1063bfe9 100644
--- a/plugins/sudoers/defaults.c
+++ b/plugins/sudoers/defaults.c
@@ -90,7 +90,7 @@ dump_defaults(void)
     struct list_member *item;
     struct def_values *def;
     char *desc;
-    debug_decl(dump_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(dump_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     for (cur = sudo_defs_table; cur->name; cur++) {
 	if (cur->desc) {
@@ -179,7 +179,7 @@ static int
 find_default(const char *name, const char *file, int lineno, bool quiet)
 {
     int i;
-    debug_decl(find_default, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(find_default, SUDOERS_DEBUG_DEFAULTS);
 
     for (i = 0; sudo_defs_table[i].name != NULL; i++) {
 	if (strcmp(name, sudo_defs_table[i].name) == 0)
@@ -206,7 +206,7 @@ parse_default_entry(struct sudo_defs_types *def, const char *val, int op,
     union sudo_defs_val *sd_un, const char *file, int lineno, bool quiet)
 {
     int rc;
-    debug_decl(parse_default_entry, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(parse_default_entry, SUDOERS_DEBUG_DEFAULTS);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: %s:%d %s=%s op=%d",
 	__func__, file, lineno, def->name, val ? val : "", op);
@@ -338,7 +338,7 @@ struct early_default *
 is_early_default(const char *name)
 {
     struct early_default *early;
-    debug_decl(is_early_default, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(is_early_default, SUDOERS_DEBUG_DEFAULTS);
 
     for (early = early_defaults; early->idx != -1; early++) {
 	if (strcmp(name, sudo_defs_table[early->idx].name) == 0)
@@ -350,7 +350,7 @@ is_early_default(const char *name)
 static bool
 run_callback(struct sudo_defs_types *def)
 {
-    debug_decl(run_callback, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(run_callback, SUDOERS_DEBUG_DEFAULTS);
 
     if (def->callback == NULL)
 	debug_return_bool(true);
@@ -366,7 +366,7 @@ set_default(const char *var, const char *val, int op, const char *file,
     int lineno, bool quiet)
 {
     int idx;
-    debug_decl(set_default, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(set_default, SUDOERS_DEBUG_DEFAULTS);
 
     idx = find_default(var, file, lineno, quiet);
     if (idx != -1) {
@@ -387,7 +387,7 @@ set_early_default(const char *var, const char *val, int op, const char *file,
     int lineno, bool quiet, struct early_default *early)
 {
     int idx;
-    debug_decl(set_early_default, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(set_early_default, SUDOERS_DEBUG_DEFAULTS);
 
     idx = find_default(var, file, lineno, quiet);
     if (idx != -1) {
@@ -409,7 +409,7 @@ run_early_defaults(void)
 {
     struct early_default *early;
     bool ret = true;
-    debug_decl(run_early_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(run_early_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     for (early = early_defaults; early->idx != -1; early++) {
 	if (early->run_callback) {
@@ -444,7 +444,7 @@ init_defaults(void)
 {
     static int firsttime = 1;
     struct sudo_defs_types *def;
-    debug_decl(init_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(init_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     /* Clear any old settings. */
     if (!firsttime) {
@@ -635,7 +635,7 @@ oom:
 static bool
 default_type_matches(struct defaults *d, int what)
 {
-    debug_decl(default_type_matches, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(default_type_matches, SUDOERS_DEBUG_DEFAULTS);
 
     switch (d->type) {
     case DEFAULTS:
@@ -670,7 +670,7 @@ static bool
 default_binding_matches(struct sudoers_parse_tree *parse_tree,
     struct defaults *d, int what)
 {
-    debug_decl(default_binding_matches, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(default_binding_matches, SUDOERS_DEBUG_DEFAULTS);
 
     switch (d->type) {
     case DEFAULTS:
@@ -706,7 +706,7 @@ update_defaults(struct sudoers_parse_tree *parse_tree,
 {
     struct defaults *d;
     bool ret = true;
-    debug_decl(update_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(update_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
 	"what: 0x%02x", what);
@@ -766,7 +766,7 @@ check_defaults(struct sudoers_parse_tree *parse_tree, bool quiet)
     struct defaults *d;
     bool ret = true;
     int idx;
-    debug_decl(check_defaults, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(check_defaults, SUDOERS_DEBUG_DEFAULTS);
 
     TAILQ_FOREACH(d, &parse_tree->defaults, entries) {
 	idx = find_default(d->var, d->file, d->lineno, quiet);
@@ -792,7 +792,7 @@ store_int(const char *str, union sudo_defs_val *sd_un)
 {
     const char *errstr;
     int i;
-    debug_decl(store_int, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_int, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->ival = 0;
@@ -813,7 +813,7 @@ store_uint(const char *str, union sudo_defs_val *sd_un)
 {
     const char *errstr;
     unsigned int u;
-    debug_decl(store_uint, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_uint, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->uival = 0;
@@ -835,7 +835,7 @@ store_timespec(const char *str, union sudo_defs_val *sd_un)
     struct timespec ts;
     char sign = '+';
     int i;
-    debug_decl(store_timespec, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_timespec, SUDOERS_DEBUG_DEFAULTS);
 
     sudo_timespecclear(&ts);
     if (str != NULL) {
@@ -885,7 +885,7 @@ store_tuple(const char *str, union sudo_defs_val *sd_un,
     struct def_values *tuple_vals)
 {
     struct def_values *v;
-    debug_decl(store_tuple, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_tuple, SUDOERS_DEBUG_DEFAULTS);
 
     /*
      * Look up tuple value by name to find enum def_tuple value.
@@ -910,7 +910,7 @@ store_tuple(const char *str, union sudo_defs_val *sd_un,
 static int
 store_str(const char *str, union sudo_defs_val *sd_un)
 {
-    debug_decl(store_str, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_str, SUDOERS_DEBUG_DEFAULTS);
 
     free(sd_un->str);
     if (str == NULL) {
@@ -927,7 +927,7 @@ store_str(const char *str, union sudo_defs_val *sd_un)
 static bool
 store_list(const char *str, union sudo_defs_val *sd_un, int op)
 {
-    debug_decl(store_list, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_list, SUDOERS_DEBUG_DEFAULTS);
 
     /* Remove all old members. */
     if (op == false || op == true)
@@ -951,7 +951,7 @@ store_list(const char *str, union sudo_defs_val *sd_un, int op)
 static bool
 store_syslogfac(const char *str, union sudo_defs_val *sd_un)
 {
-    debug_decl(store_syslogfac, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_syslogfac, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->ival = false;
@@ -963,7 +963,7 @@ store_syslogfac(const char *str, union sudo_defs_val *sd_un)
 static bool
 store_syslogpri(const char *str, union sudo_defs_val *sd_un)
 {
-    debug_decl(store_syslogpri, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_syslogpri, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->ival = -1;
@@ -977,7 +977,7 @@ store_mode(const char *str, union sudo_defs_val *sd_un)
 {
     mode_t mode;
     const char *errstr;
-    debug_decl(store_mode, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_mode, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->mode = ACCESSPERMS;
@@ -996,7 +996,7 @@ store_mode(const char *str, union sudo_defs_val *sd_un)
 static bool
 store_timeout(const char *str, union sudo_defs_val *sd_un)
 {
-    debug_decl(store_mode, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(store_mode, SUDOERS_DEBUG_DEFAULTS);
 
     if (str == NULL) {
 	sd_un->ival = 0;
@@ -1017,7 +1017,7 @@ list_op(const char *str, size_t len, union sudo_defs_val *sd_un,
     enum list_ops op)
 {
     struct list_member *cur, *prev = NULL;
-    debug_decl(list_op, SUDOERS_DEBUG_DEFAULTS)
+    debug_decl(list_op, SUDOERS_DEBUG_DEFAULTS);
 
     if (op == freeall) {
 	while ((cur = SLIST_FIRST(&sd_un->list)) != NULL) {
diff --git a/plugins/sudoers/digestname.c b/plugins/sudoers/digestname.c
index 88eb14342..a34505507 100644
--- a/plugins/sudoers/digestname.c
+++ b/plugins/sudoers/digestname.c
@@ -35,7 +35,7 @@ const char *
 digest_type_to_name(int digest_type)
 {
     const char *digest_name;
-    debug_decl(digest_type_to_name, SUDOERS_DEBUG_UTIL)
+    debug_decl(digest_type_to_name, SUDOERS_DEBUG_UTIL);
 
     switch (digest_type) {
     case SUDO_DIGEST_SHA224:
diff --git a/plugins/sudoers/editor.c b/plugins/sudoers/editor.c
index 31d8b6e5b..391bb4968 100644
--- a/plugins/sudoers/editor.c
+++ b/plugins/sudoers/editor.c
@@ -57,7 +57,7 @@ resolve_editor(const char *ed, size_t edlen, int nfiles, char **files,
     const char *edend = ed + edlen;
     struct stat user_editor_sb;
     int nargc;
-    debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL)
+    debug_decl(resolve_editor, SUDOERS_DEBUG_UTIL);
 
     /*
      * Split editor into an argument vector, including files to edit.
@@ -134,7 +134,7 @@ find_editor(int nfiles, char **files, int *argc_out, char ***argv_out,
 {
     char *ev[3], *editor_path = NULL;
     unsigned int i;
-    debug_decl(find_editor, SUDOERS_DEBUG_UTIL)
+    debug_decl(find_editor, SUDOERS_DEBUG_UTIL);
 
     /*
      * If any of SUDO_EDITOR, VISUAL or EDITOR are set, choose the first one.
diff --git a/plugins/sudoers/env.c b/plugins/sudoers/env.c
index 5df02c443..dd5b657b6 100644
--- a/plugins/sudoers/env.c
+++ b/plugins/sudoers/env.c
@@ -242,7 +242,7 @@ env_init(char * const envp[])
 {
     char * const *ep;
     size_t len;
-    debug_decl(env_init, SUDOERS_DEBUG_ENV)
+    debug_decl(env_init, SUDOERS_DEBUG_ENV);
 
     if (envp == NULL) {
 	/* Free the old envp we allocated, if any. */
@@ -400,7 +400,7 @@ static int
 sudo_putenv(char *str, bool dupcheck, bool overwrite)
 {
     int ret;
-    debug_decl(sudo_putenv, SUDOERS_DEBUG_ENV)
+    debug_decl(sudo_putenv, SUDOERS_DEBUG_ENV);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "sudo_putenv: %s", str);
 
@@ -425,7 +425,7 @@ sudo_setenv2(const char *var, const char *val, bool dupcheck, bool overwrite)
     char *estring;
     size_t esize;
     int ret = -1;
-    debug_decl(sudo_setenv2, SUDOERS_DEBUG_ENV)
+    debug_decl(sudo_setenv2, SUDOERS_DEBUG_ENV);
 
     esize = strlen(var) + 1 + strlen(val) + 1;
     if ((estring = malloc(esize)) == NULL) {
@@ -547,7 +547,7 @@ int
 sudo_unsetenv(const char *name)
 {
     int ret;
-    debug_decl(sudo_unsetenv, SUDOERS_DEBUG_ENV)
+    debug_decl(sudo_unsetenv, SUDOERS_DEBUG_ENV);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "sudo_unsetenv: %s", name);
 
@@ -587,7 +587,7 @@ char *
 sudo_getenv(const char *name)
 {
     char *val;
-    debug_decl(sudo_getenv, SUDOERS_DEBUG_ENV)
+    debug_decl(sudo_getenv, SUDOERS_DEBUG_ENV);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "sudo_getenv: %s", name);
 
@@ -605,7 +605,7 @@ matches_env_list(const char *var, struct list_members *list, bool *full_match)
 {
     struct list_member *cur;
     bool is_logname = false;
-    debug_decl(matches_env_list, SUDOERS_DEBUG_ENV)
+    debug_decl(matches_env_list, SUDOERS_DEBUG_ENV);
 
     switch (*var) {
     case 'L':
@@ -652,7 +652,7 @@ static bool
 matches_env_delete(const char *var)
 {
     bool full_match;	/* unused */
-    debug_decl(matches_env_delete, SUDOERS_DEBUG_ENV)
+    debug_decl(matches_env_delete, SUDOERS_DEBUG_ENV);
 
     /* Skip anything listed in env_delete. */
     debug_return_bool(matches_env_list(var, &def_env_delete, &full_match));
@@ -667,7 +667,7 @@ tz_is_sane(const char *tzval)
 {
     const char *cp;
     char lastch;
-    debug_decl(tz_is_sane, SUDOERS_DEBUG_ENV)
+    debug_decl(tz_is_sane, SUDOERS_DEBUG_ENV);
 
     /* tzcode treats a value beginning with a ':' as a path. */
     if (tzval[0] == ':')
@@ -715,7 +715,7 @@ static int
 matches_env_check(const char *var, bool *full_match)
 {
     int keepit = -1;
-    debug_decl(matches_env_check, SUDOERS_DEBUG_ENV)
+    debug_decl(matches_env_check, SUDOERS_DEBUG_ENV);
 
     /* Skip anything listed in env_check that includes '/' or '%'. */
     if (matches_env_list(var, &def_env_check, full_match)) {
@@ -739,7 +739,7 @@ static bool
 matches_env_keep(const char *var, bool *full_match)
 {
     bool keepit = false;
-    debug_decl(matches_env_keep, SUDOERS_DEBUG_ENV)
+    debug_decl(matches_env_keep, SUDOERS_DEBUG_ENV);
 
     /* Preserve SHELL variable for "sudo -s". */
     if (ISSET(sudo_mode, MODE_SHELL) && strncmp(var, "SHELL=", 6) == 0) {
@@ -780,7 +780,7 @@ env_should_keep(const char *var)
     int keepit;
     bool full_match = false;
     const char *cp;
-    debug_decl(env_should_keep, SUDOERS_DEBUG_ENV)
+    debug_decl(env_should_keep, SUDOERS_DEBUG_ENV);
 
     keepit = matches_env_check(var, &full_match);
     if (keepit == -1)
@@ -810,7 +810,7 @@ env_merge(char * const envp[])
 {
     char * const *ep;
     bool ret = true;
-    debug_decl(env_merge, SUDOERS_DEBUG_ENV)
+    debug_decl(env_merge, SUDOERS_DEBUG_ENV);
 
     for (ep = envp; *ep != NULL; ep++) {
 	/* XXX - avoid checking value here, should only check name */
@@ -887,7 +887,7 @@ rebuild_env(void)
     char idbuf[MAX_UID_T_LEN + 1];
     unsigned int didvar;
     bool reset_home = false;
-    debug_decl(rebuild_env, SUDOERS_DEBUG_ENV)
+    debug_decl(rebuild_env, SUDOERS_DEBUG_ENV);
 
     /*
      * Either clean out the environment or reset to a safe default.
@@ -1144,7 +1144,7 @@ insert_env_vars(char * const envp[])
 {
     char * const *ep;
     bool ret = true;
-    debug_decl(insert_env_vars, SUDOERS_DEBUG_ENV)
+    debug_decl(insert_env_vars, SUDOERS_DEBUG_ENV);
 
     /* Add user-specified environment variables. */
     if (envp != NULL) {
@@ -1171,7 +1171,7 @@ validate_env_vars(char * const env_vars[])
     char * const *ep;
     char *eq, errbuf[4096];
     bool okvar, ret = true;
-    debug_decl(validate_env_vars, SUDOERS_DEBUG_ENV)
+    debug_decl(validate_env_vars, SUDOERS_DEBUG_ENV);
 
     if (env_vars == NULL)
 	debug_return_bool(true);	/* nothing to do */
@@ -1214,7 +1214,7 @@ static void *
 env_file_open_local(const char *path)
 {
     struct env_file_local *efl;
-    debug_decl(env_file_open_local, SUDOERS_DEBUG_ENV)
+    debug_decl(env_file_open_local, SUDOERS_DEBUG_ENV);
 
     efl = calloc(1, sizeof(*efl));
     if (efl != NULL) {
@@ -1232,7 +1232,7 @@ static void
 env_file_close_local(void *cookie)
 {
     struct env_file_local *efl = cookie;
-    debug_decl(env_file_close_local, SUDOERS_DEBUG_ENV)
+    debug_decl(env_file_close_local, SUDOERS_DEBUG_ENV);
 
     if (efl != NULL) {
 	if (efl->fp != NULL)
@@ -1259,7 +1259,7 @@ env_file_next_local(void *cookie, int *errnum)
     struct env_file_local *efl = cookie;
     char *var, *val, *ret = NULL;
     size_t var_len, val_len;
-    debug_decl(env_file_next_local, SUDOERS_DEBUG_ENV)
+    debug_decl(env_file_next_local, SUDOERS_DEBUG_ENV);
 
     *errnum = 0;
     if (efl->fp == NULL)
@@ -1344,7 +1344,7 @@ read_env_file(const char *path, bool overwrite, bool restricted)
     char *envstr;
     void *cookie;
     int errnum;
-    debug_decl(read_env_file, SUDOERS_DEBUG_ENV)
+    debug_decl(read_env_file, SUDOERS_DEBUG_ENV);
 
     /*
      * The environment file may be handled differently depending on
@@ -1393,7 +1393,7 @@ init_envtables(void)
 {
     struct list_member *cur;
     const char **p;
-    debug_decl(init_envtables, SUDOERS_DEBUG_ENV)
+    debug_decl(init_envtables, SUDOERS_DEBUG_ENV);
 
     /* Fill in the "env_delete" list. */
     for (p = initial_badenv_table; *p; p++) {
diff --git a/plugins/sudoers/env_pattern.c b/plugins/sudoers/env_pattern.c
index 22b17a5d9..691b5acaf 100644
--- a/plugins/sudoers/env_pattern.c
+++ b/plugins/sudoers/env_pattern.c
@@ -43,7 +43,7 @@ matches_env_pattern(const char *pattern, const char *var, bool *full_match)
     bool iswild = false, match = false;
     bool saw_sep = false;
     const char *cp;
-    debug_decl(matches_env_pattern, SUDOERS_DEBUG_ENV)
+    debug_decl(matches_env_pattern, SUDOERS_DEBUG_ENV);
 
     /* Locate position of the '=' separator in var=value. */
     sep_pos = strcspn(var, "=");
diff --git a/plugins/sudoers/file.c b/plugins/sudoers/file.c
index 5028ce01c..b9c3d26f0 100644
--- a/plugins/sudoers/file.c
+++ b/plugins/sudoers/file.c
@@ -51,7 +51,7 @@ struct sudo_file_handle {
 static int
 sudo_file_close(struct sudo_nss *nss)
 {
-    debug_decl(sudo_file_close, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_file_close, SUDOERS_DEBUG_NSS);
     struct sudo_file_handle *handle = nss->handle;
 
     if (handle != NULL) {
@@ -69,7 +69,7 @@ sudo_file_close(struct sudo_nss *nss)
 static int
 sudo_file_open(struct sudo_nss *nss)
 {
-    debug_decl(sudo_file_open, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_file_open, SUDOERS_DEBUG_NSS);
     struct sudo_file_handle *handle;
 
     if (def_ignore_local_sudoers)
@@ -101,7 +101,7 @@ sudo_file_open(struct sudo_nss *nss)
 static struct sudoers_parse_tree *
 sudo_file_parse(struct sudo_nss *nss)
 {
-    debug_decl(sudo_file_close, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_file_close, SUDOERS_DEBUG_NSS);
     struct sudo_file_handle *handle = nss->handle;
 
     if (handle == NULL || handle->fp == NULL) {
@@ -133,7 +133,7 @@ sudo_file_parse(struct sudo_nss *nss)
 static int
 sudo_file_query(struct sudo_nss *nss, struct passwd *pw)
 {
-    debug_decl(sudo_file_query, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_file_query, SUDOERS_DEBUG_NSS);
     debug_return_int(0);
 }
 
@@ -143,7 +143,7 @@ sudo_file_query(struct sudo_nss *nss, struct passwd *pw)
 static int
 sudo_file_getdefs(struct sudo_nss *nss)
 {
-    debug_decl(sudo_file_getdefs, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_file_getdefs, SUDOERS_DEBUG_NSS);
     debug_return_int(0);
 }
 
diff --git a/plugins/sudoers/filedigest.c b/plugins/sudoers/filedigest.c
index c98023f9c..3b6087cd9 100644
--- a/plugins/sudoers/filedigest.c
+++ b/plugins/sudoers/filedigest.c
@@ -54,7 +54,7 @@ sudo_filedigest(int fd, const char *file, int digest_type, size_t *digest_len)
     FILE *fp = NULL;
     size_t nread;
     int fd2;
-    debug_decl(sudo_filedigest, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudo_filedigest, SUDOERS_DEBUG_UTIL);
 
     *digest_len = sudo_digest_getlen(digest_type);
     if (*digest_len == (size_t)-1) {
diff --git a/plugins/sudoers/find_path.c b/plugins/sudoers/find_path.c
index 0656339f8..2cfe03f03 100644
--- a/plugins/sudoers/find_path.c
+++ b/plugins/sudoers/find_path.c
@@ -54,7 +54,7 @@ cmnd_allowed(char *cmnd, size_t cmnd_size, struct stat *cmnd_sbp,
 {
     const char *cmnd_base;
     char * const *wl;
-    debug_decl(cmnd_allowed, SUDOERS_DEBUG_UTIL)
+    debug_decl(cmnd_allowed, SUDOERS_DEBUG_UTIL);
 
     if (!sudo_goodpath(cmnd, cmnd_sbp))
 	debug_return_bool(false);
@@ -106,7 +106,7 @@ find_path(const char *infile, char **outfile, struct stat *sbp,
     bool found = false;
     bool checkdot = false;
     int len;
-    debug_decl(find_path, SUDOERS_DEBUG_UTIL)
+    debug_decl(find_path, SUDOERS_DEBUG_UTIL);
 
     /*
      * If we were given a fully qualified or relative path
diff --git a/plugins/sudoers/fmtsudoers.c b/plugins/sudoers/fmtsudoers.c
index c93281f71..68e6a076e 100644
--- a/plugins/sudoers/fmtsudoers.c
+++ b/plugins/sudoers/fmtsudoers.c
@@ -51,7 +51,7 @@ sudoers_format_member_int(struct sudo_lbuf *lbuf,
     struct alias *a;
     struct member *m;
     struct sudo_command *c;
-    debug_decl(sudoers_format_member_int, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_member_int, SUDOERS_DEBUG_UTIL);
 
     switch (type) {
 	case ALL:
@@ -140,7 +140,7 @@ sudoers_defaults_to_tags(const char *var, const char *val, int op,
     struct cmndtag *tags)
 {
     bool ret = true;
-    debug_decl(sudoers_defaults_to_tags, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_defaults_to_tags, SUDOERS_DEBUG_UTIL);
 
     if (op == true || op == false) {
 	if (strcmp(var, "authenticate") == 0) {
@@ -176,7 +176,7 @@ sudoers_defaults_list_to_tags(struct defaults_list *defs, struct cmndtag *tags)
 {
     bool ret = true;
     struct defaults *d;
-    debug_decl(sudoers_defaults_list_to_tags, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_defaults_list_to_tags, SUDOERS_DEBUG_UTIL);
 
     TAGS_INIT(*tags);
     if (defs != NULL) {
@@ -212,7 +212,7 @@ sudoers_format_cmndspec(struct sudo_lbuf *lbuf,
     struct sudoers_parse_tree *parse_tree, struct cmndspec *cs,
     struct cmndspec *prev_cs, struct cmndtag tags, bool expand_aliases)
 {
-    debug_decl(sudoers_format_cmndspec, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_cmndspec, SUDOERS_DEBUG_UTIL);
 
     /* Merge privilege-level tags with cmndspec tags. */
     TAGS_MERGE(tags, cs->tags);
@@ -276,7 +276,7 @@ sudoers_format_privilege(struct sudo_lbuf *lbuf,
     struct cmndspec *cs, *prev_cs;
     struct cmndtag tags;
     struct member *m;
-    debug_decl(sudoers_format_privilege, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_privilege, SUDOERS_DEBUG_UTIL);
 
     /* Convert per-privilege defaults to tags. */
     sudoers_defaults_list_to_tags(&priv->defaults, &tags);
@@ -339,7 +339,7 @@ sudoers_format_userspec(struct sudo_lbuf *lbuf,
     struct privilege *priv;
     struct sudoers_comment *comment;
     struct member *m;
-    debug_decl(sudoers_format_userspec, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_userspec, SUDOERS_DEBUG_UTIL);
 
     /* Print comments (if any). */
     STAILQ_FOREACH(comment, &us->comments, entries) {
@@ -376,7 +376,7 @@ sudoers_format_userspecs(struct sudo_lbuf *lbuf,
     bool expand_aliases, bool flush)
 {
     struct userspec *us;
-    debug_decl(sudoers_format_userspecs, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_userspecs, SUDOERS_DEBUG_UTIL);
 
     TAILQ_FOREACH(us, &parse_tree->userspecs, entries) {
 	if (separator != NULL && us != TAILQ_FIRST(&parse_tree->userspecs))
@@ -395,7 +395,7 @@ sudoers_format_userspecs(struct sudo_lbuf *lbuf,
 bool
 sudoers_format_default(struct sudo_lbuf *lbuf, struct defaults *d)
 {
-    debug_decl(sudoers_format_default, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_default, SUDOERS_DEBUG_UTIL);
 
     if (d->val != NULL) {
 	sudo_lbuf_append(lbuf, "%s%s", d->var,
@@ -425,7 +425,7 @@ sudoers_format_default_line( struct sudo_lbuf *lbuf,
 {
     struct member *m;
     int alias_type;
-    debug_decl(sudoers_format_default_line, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_format_default_line, SUDOERS_DEBUG_UTIL);
 
     /* Print Defaults type and binding (if present) */
     switch (d->type) {
diff --git a/plugins/sudoers/gc.c b/plugins/sudoers/gc.c
index 729068364..73a812339 100644
--- a/plugins/sudoers/gc.c
+++ b/plugins/sudoers/gc.c
@@ -49,7 +49,7 @@ sudoers_gc_add(enum sudoers_gc_types type, void *v)
 {
 #ifdef NO_LEAKS
     struct sudoers_gc_entry *gc;
-    debug_decl(sudoers_gc_add, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_gc_add, SUDOERS_DEBUG_UTIL);
 
     if (v == NULL)
 	debug_return_bool(false);
@@ -84,7 +84,7 @@ sudoers_gc_remove(enum sudoers_gc_types type, void *v)
 {
 #ifdef NO_LEAKS
     struct sudoers_gc_entry *gc, *prev = NULL;
-    debug_decl(sudoers_gc_remove, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_gc_remove, SUDOERS_DEBUG_UTIL);
 
     SLIST_FOREACH(gc, &sudoers_gc_list, entries) {
 	switch (gc->type) {
@@ -119,7 +119,7 @@ sudoers_gc_run(void)
 {
     struct sudoers_gc_entry *gc;
     char **cur;
-    debug_decl(sudoers_gc_run, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_gc_run, SUDOERS_DEBUG_UTIL);
 
     /* Collect garbage. */
     while ((gc = SLIST_FIRST(&sudoers_gc_list))) {
diff --git a/plugins/sudoers/gentime.c b/plugins/sudoers/gentime.c
index ccc717343..25f554894 100644
--- a/plugins/sudoers/gentime.c
+++ b/plugins/sudoers/gentime.c
@@ -60,7 +60,7 @@ parse_gentime(const char *timestr)
     size_t len;
     int items, tzoff = 0;
     bool islocal = false;
-    debug_decl(parse_gentime, SUDOERS_DEBUG_PARSER)
+    debug_decl(parse_gentime, SUDOERS_DEBUG_PARSER);
 
     /* Make a copy of the time without time zone for easy parsing. */
     len = strspn(timestr, "0123456789.,");
diff --git a/plugins/sudoers/getspwuid.c b/plugins/sudoers/getspwuid.c
index a6bdb4b83..46014534a 100644
--- a/plugins/sudoers/getspwuid.c
+++ b/plugins/sudoers/getspwuid.c
@@ -71,7 +71,7 @@ char *
 sudo_getepw(const struct passwd *pw)
 {
     char *epw = NULL;
-    debug_decl(sudo_getepw, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_getepw, SUDOERS_DEBUG_AUTH);
 
     /* If there is a function to check for shadow enabled, use it... */
 #ifdef HAVE_ISCOMSEC
@@ -118,7 +118,7 @@ done:
 void
 sudo_setspent(void)
 {
-    debug_decl(sudo_setspent, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_setspent, SUDOERS_DEBUG_AUTH);
 
 #ifdef HAVE_GETPRPWNAM
     setprpwent();
@@ -132,7 +132,7 @@ sudo_setspent(void)
 void
 sudo_endspent(void)
 {
-    debug_decl(sudo_endspent, SUDOERS_DEBUG_AUTH)
+    debug_decl(sudo_endspent, SUDOERS_DEBUG_AUTH);
 
 #ifdef HAVE_GETPRPWNAM
     endprpwent();
diff --git a/plugins/sudoers/goodpath.c b/plugins/sudoers/goodpath.c
index 5f183d18b..db3c755c8 100644
--- a/plugins/sudoers/goodpath.c
+++ b/plugins/sudoers/goodpath.c
@@ -49,7 +49,7 @@ bool
 sudo_goodpath(const char *path, struct stat *sbp)
 {
     bool ret = false;
-    debug_decl(sudo_goodpath, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudo_goodpath, SUDOERS_DEBUG_UTIL);
 
     if (path != NULL) {
 	struct stat sb;
diff --git a/plugins/sudoers/gram.c b/plugins/sudoers/gram.c
index f7c1155bc..e5b6f140f 100644
--- a/plugins/sudoers/gram.c
+++ b/plugins/sudoers/gram.c
@@ -682,7 +682,7 @@ int yyparse(void);
 void
 sudoerserror(const char *s)
 {
-    debug_decl(sudoerserror, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudoerserror, SUDOERS_DEBUG_PARSER);
 
     /* Save the line the first error occurred on. */
     if (errorlineno == -1) {
@@ -712,7 +712,7 @@ static struct defaults *
 new_default(char *var, char *val, short op)
 {
     struct defaults *d;
-    debug_decl(new_default, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_default, SUDOERS_DEBUG_PARSER);
 
     if ((d = calloc(1, sizeof(struct defaults))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -736,7 +736,7 @@ static struct member *
 new_member(char *name, int type)
 {
     struct member *m;
-    debug_decl(new_member, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_member, SUDOERS_DEBUG_PARSER);
 
     if ((m = calloc(1, sizeof(struct member))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -755,7 +755,7 @@ static struct command_digest *
 new_digest(int digest_type, char *digest_str)
 {
     struct command_digest *digest;
-    debug_decl(new_digest, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_digest, SUDOERS_DEBUG_PARSER);
 
     if ((digest = malloc(sizeof(*digest))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -786,7 +786,7 @@ add_defaults(int type, struct member *bmem, struct defaults *defs)
     struct defaults *d, *next;
     struct member_list *binding;
     bool ret = true;
-    debug_decl(add_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(add_defaults, SUDOERS_DEBUG_PARSER);
 
     if (defs != NULL) {
 	/*
@@ -825,7 +825,7 @@ static bool
 add_userspec(struct member *members, struct privilege *privs)
 {
     struct userspec *u;
-    debug_decl(add_userspec, SUDOERS_DEBUG_PARSER)
+    debug_decl(add_userspec, SUDOERS_DEBUG_PARSER);
 
     if ((u = calloc(1, sizeof(*u))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -848,7 +848,7 @@ add_userspec(struct member *members, struct privilege *privs)
 void
 free_member(struct member *m)
 {
-    debug_decl(free_member, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_member, SUDOERS_DEBUG_PARSER);
 
     if (m->type == COMMAND) {
 	    struct sudo_command *c = (struct sudo_command *)m->name;
@@ -872,7 +872,7 @@ void
 free_members(struct member_list *members)
 {
     struct member *m;
-    debug_decl(free_members, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_members, SUDOERS_DEBUG_PARSER);
 
     while ((m = TAILQ_FIRST(members)) != NULL) {
 	TAILQ_REMOVE(members, m, entries);
@@ -887,7 +887,7 @@ free_defaults(struct defaults_list *defs)
 {
     struct member_list *prev_binding = NULL;
     struct defaults *def;
-    debug_decl(free_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_defaults, SUDOERS_DEBUG_PARSER);
 
     while ((def = TAILQ_FIRST(defs)) != NULL) {
 	TAILQ_REMOVE(defs, def, entries);
@@ -900,7 +900,7 @@ free_defaults(struct defaults_list *defs)
 void
 free_default(struct defaults *def, struct member_list **binding)
 {
-    debug_decl(free_default, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_default, SUDOERS_DEBUG_PARSER);
 
     if (def->binding != *binding) {
 	*binding = def->binding;
@@ -930,7 +930,7 @@ free_privilege(struct privilege *priv)
 #ifdef HAVE_PRIV_SET
     char *privs = NULL, *limitprivs = NULL;
 #endif /* HAVE_PRIV_SET */
-    debug_decl(free_privilege, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_privilege, SUDOERS_DEBUG_PARSER);
 
     free(priv->ldap_role);
     free_members(&priv->hostlist);
@@ -985,7 +985,7 @@ void
 free_userspecs(struct userspec_list *usl)
 {
     struct userspec *us;
-    debug_decl(free_userspecs, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_userspecs, SUDOERS_DEBUG_PARSER);
 
     while ((us = TAILQ_FIRST(usl)) != NULL) {
 	TAILQ_REMOVE(usl, us, entries);
@@ -1000,7 +1000,7 @@ free_userspec(struct userspec *us)
 {
     struct privilege *priv;
     struct sudoers_comment *comment;
-    debug_decl(free_userspec, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_userspec, SUDOERS_DEBUG_PARSER);
 
     free_members(&us->users);
     while ((priv = TAILQ_FIRST(&us->privileges)) != NULL) {
@@ -1064,7 +1064,7 @@ bool
 init_parser(const char *path, bool quiet, bool strict)
 {
     bool ret = true;
-    debug_decl(init_parser, SUDOERS_DEBUG_PARSER)
+    debug_decl(init_parser, SUDOERS_DEBUG_PARSER);
 
     free_parse_tree(&parsed_policy);
     init_lexer();
diff --git a/plugins/sudoers/gram.y b/plugins/sudoers/gram.y
index 8deda48d5..14c7f42ee 100644
--- a/plugins/sudoers/gram.y
+++ b/plugins/sudoers/gram.y
@@ -911,7 +911,7 @@ group		:	ALIAS {
 void
 sudoerserror(const char *s)
 {
-    debug_decl(sudoerserror, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudoerserror, SUDOERS_DEBUG_PARSER);
 
     /* Save the line the first error occurred on. */
     if (errorlineno == -1) {
@@ -941,7 +941,7 @@ static struct defaults *
 new_default(char *var, char *val, short op)
 {
     struct defaults *d;
-    debug_decl(new_default, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_default, SUDOERS_DEBUG_PARSER);
 
     if ((d = calloc(1, sizeof(struct defaults))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -965,7 +965,7 @@ static struct member *
 new_member(char *name, int type)
 {
     struct member *m;
-    debug_decl(new_member, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_member, SUDOERS_DEBUG_PARSER);
 
     if ((m = calloc(1, sizeof(struct member))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -984,7 +984,7 @@ static struct command_digest *
 new_digest(int digest_type, char *digest_str)
 {
     struct command_digest *digest;
-    debug_decl(new_digest, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_digest, SUDOERS_DEBUG_PARSER);
 
     if ((digest = malloc(sizeof(*digest))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -1015,7 +1015,7 @@ add_defaults(int type, struct member *bmem, struct defaults *defs)
     struct defaults *d, *next;
     struct member_list *binding;
     bool ret = true;
-    debug_decl(add_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(add_defaults, SUDOERS_DEBUG_PARSER);
 
     if (defs != NULL) {
 	/*
@@ -1054,7 +1054,7 @@ static bool
 add_userspec(struct member *members, struct privilege *privs)
 {
     struct userspec *u;
-    debug_decl(add_userspec, SUDOERS_DEBUG_PARSER)
+    debug_decl(add_userspec, SUDOERS_DEBUG_PARSER);
 
     if ((u = calloc(1, sizeof(*u))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -1077,7 +1077,7 @@ add_userspec(struct member *members, struct privilege *privs)
 void
 free_member(struct member *m)
 {
-    debug_decl(free_member, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_member, SUDOERS_DEBUG_PARSER);
 
     if (m->type == COMMAND) {
 	    struct sudo_command *c = (struct sudo_command *)m->name;
@@ -1101,7 +1101,7 @@ void
 free_members(struct member_list *members)
 {
     struct member *m;
-    debug_decl(free_members, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_members, SUDOERS_DEBUG_PARSER);
 
     while ((m = TAILQ_FIRST(members)) != NULL) {
 	TAILQ_REMOVE(members, m, entries);
@@ -1116,7 +1116,7 @@ free_defaults(struct defaults_list *defs)
 {
     struct member_list *prev_binding = NULL;
     struct defaults *def;
-    debug_decl(free_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_defaults, SUDOERS_DEBUG_PARSER);
 
     while ((def = TAILQ_FIRST(defs)) != NULL) {
 	TAILQ_REMOVE(defs, def, entries);
@@ -1129,7 +1129,7 @@ free_defaults(struct defaults_list *defs)
 void
 free_default(struct defaults *def, struct member_list **binding)
 {
-    debug_decl(free_default, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_default, SUDOERS_DEBUG_PARSER);
 
     if (def->binding != *binding) {
 	*binding = def->binding;
@@ -1159,7 +1159,7 @@ free_privilege(struct privilege *priv)
 #ifdef HAVE_PRIV_SET
     char *privs = NULL, *limitprivs = NULL;
 #endif /* HAVE_PRIV_SET */
-    debug_decl(free_privilege, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_privilege, SUDOERS_DEBUG_PARSER);
 
     free(priv->ldap_role);
     free_members(&priv->hostlist);
@@ -1214,7 +1214,7 @@ void
 free_userspecs(struct userspec_list *usl)
 {
     struct userspec *us;
-    debug_decl(free_userspecs, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_userspecs, SUDOERS_DEBUG_PARSER);
 
     while ((us = TAILQ_FIRST(usl)) != NULL) {
 	TAILQ_REMOVE(usl, us, entries);
@@ -1229,7 +1229,7 @@ free_userspec(struct userspec *us)
 {
     struct privilege *priv;
     struct sudoers_comment *comment;
-    debug_decl(free_userspec, SUDOERS_DEBUG_PARSER)
+    debug_decl(free_userspec, SUDOERS_DEBUG_PARSER);
 
     free_members(&us->users);
     while ((priv = TAILQ_FIRST(&us->privileges)) != NULL) {
@@ -1293,7 +1293,7 @@ bool
 init_parser(const char *path, bool quiet, bool strict)
 {
     bool ret = true;
-    debug_decl(init_parser, SUDOERS_DEBUG_PARSER)
+    debug_decl(init_parser, SUDOERS_DEBUG_PARSER);
 
     free_parse_tree(&parsed_policy);
     init_lexer();
diff --git a/plugins/sudoers/group_plugin.c b/plugins/sudoers/group_plugin.c
index 6f2957891..ada703248 100644
--- a/plugins/sudoers/group_plugin.c
+++ b/plugins/sudoers/group_plugin.c
@@ -60,7 +60,7 @@ group_plugin_load(char *plugin_info)
     char *args, path[PATH_MAX];
     char **argv = NULL;
     int len, rc = -1;
-    debug_decl(group_plugin_load, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_load, SUDOERS_DEBUG_UTIL);
 
     /*
      * Fill in .so path and split out args (if any).
@@ -170,7 +170,7 @@ done:
 void
 group_plugin_unload(void)
 {
-    debug_decl(group_plugin_unload, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_unload, SUDOERS_DEBUG_UTIL);
 
     if (group_plugin != NULL) {
 	(group_plugin->cleanup)();
@@ -187,7 +187,7 @@ int
 group_plugin_query(const char *user, const char *group,
     const struct passwd *pwd)
 {
-    debug_decl(group_plugin_query, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_query, SUDOERS_DEBUG_UTIL);
 
     if (group_plugin == NULL)
 	debug_return_int(false);
@@ -203,14 +203,14 @@ group_plugin_query(const char *user, const char *group,
 int
 group_plugin_load(char *plugin_info)
 {
-    debug_decl(group_plugin_load, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_load, SUDOERS_DEBUG_UTIL);
     debug_return_int(false);
 }
 
 void
 group_plugin_unload(void)
 {
-    debug_decl(group_plugin_unload, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_unload, SUDOERS_DEBUG_UTIL);
     debug_return;
 }
 
@@ -218,7 +218,7 @@ int
 group_plugin_query(const char *user, const char *group,
     const struct passwd *pwd)
 {
-    debug_decl(group_plugin_query, SUDOERS_DEBUG_UTIL)
+    debug_decl(group_plugin_query, SUDOERS_DEBUG_UTIL);
     debug_return_int(false);
 }
 
@@ -231,7 +231,7 @@ bool
 cb_group_plugin(const union sudo_defs_val *sd_un)
 {
     bool rc = true;
-    debug_decl(cb_group_plugin, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(cb_group_plugin, SUDOERS_DEBUG_PLUGIN);
 
     /* Unload any existing group plugin before loading a new one. */
     group_plugin_unload();
diff --git a/plugins/sudoers/hexchar.c b/plugins/sudoers/hexchar.c
index 07e892bf5..6ef72cc9c 100644
--- a/plugins/sudoers/hexchar.c
+++ b/plugins/sudoers/hexchar.c
@@ -37,7 +37,7 @@ hexchar(const char *s)
 {
     unsigned char result[2];
     int i;
-    debug_decl(hexchar, SUDOERS_DEBUG_UTIL)
+    debug_decl(hexchar, SUDOERS_DEBUG_UTIL);
 
     for (i = 0; i < 2; i++) {
 	switch (s[i]) {
diff --git a/plugins/sudoers/interfaces.c b/plugins/sudoers/interfaces.c
index 4be665e43..072901369 100644
--- a/plugins/sudoers/interfaces.c
+++ b/plugins/sudoers/interfaces.c
@@ -63,7 +63,7 @@ set_interfaces(const char *ai)
     char *addrinfo, *addr, *mask, *last;
     struct interface *ifp;
     bool ret = false;
-    debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF)
+    debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF);
 
     if ((addrinfo = strdup(ai)) == NULL)
 	debug_return_bool(false);
@@ -130,7 +130,7 @@ dump_interfaces(const char *ai)
 {
     const char *cp, *ep;
     const char *ai_end = ai + strlen(ai);
-    debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF)
+    debug_decl(set_interfaces, SUDOERS_DEBUG_NETIF);
 
     sudo_printf(SUDO_CONV_INFO_MSG,
 	_("Local IP address and netmask pairs:\n"));
diff --git a/plugins/sudoers/iolog.c b/plugins/sudoers/iolog.c
index 6b45b7474..0ac9c9d9f 100644
--- a/plugins/sudoers/iolog.c
+++ b/plugins/sudoers/iolog.c
@@ -72,7 +72,7 @@ cb_maxseq(const union sudo_defs_val *sd_un)
 {
     const char *errstr;
     unsigned int value;
-    debug_decl(cb_maxseq, SUDO_DEBUG_UTIL)
+    debug_decl(cb_maxseq, SUDO_DEBUG_UTIL);
 
     value = sudo_strtonum(sd_un->str, 0, SESSID_MAX, &errstr);
     if (errstr != NULL) {
@@ -96,7 +96,7 @@ cb_iolog_user(const union sudo_defs_val *sd_un)
 {
     const char *name = sd_un->str;
     struct passwd *pw;
-    debug_decl(cb_iolog_user, SUDOERS_DEBUG_UTIL)
+    debug_decl(cb_iolog_user, SUDOERS_DEBUG_UTIL);
 
     /* NULL name means reset to default. */
     if (name == NULL) {
@@ -121,7 +121,7 @@ cb_iolog_group(const union sudo_defs_val *sd_un)
 {
     const char *name = sd_un->str;
     struct group *gr;
-    debug_decl(cb_iolog_group, SUDOERS_DEBUG_UTIL)
+    debug_decl(cb_iolog_group, SUDOERS_DEBUG_UTIL);
 
     /* NULL name means reset to default. */
     if (name == NULL) {
@@ -158,7 +158,7 @@ deserialize_stringlist(const char *s)
     struct sudoers_string *str;
     const char *s_end = s + strlen(s);
     const char *cp, *ep;
-    debug_decl(deserialize_stringlist, SUDOERS_DEBUG_UTIL)
+    debug_decl(deserialize_stringlist, SUDOERS_DEBUG_UTIL);
 
     if ((strlist = str_list_alloc()) == NULL)
 	debug_return_ptr(NULL);
@@ -201,7 +201,7 @@ iolog_deserialize_info(struct iolog_details *details, char * const user_info[],
     id_t id;
     uid_t runas_uid = 0;
     gid_t runas_gid = 0;
-    debug_decl(iolog_deserialize_info, SUDOERS_DEBUG_UTIL)
+    debug_decl(iolog_deserialize_info, SUDOERS_DEBUG_UTIL);
 
     details->lines = 24;
     details->cols = 80;
@@ -462,7 +462,7 @@ static bool
 write_info_log(int dfd, char *iolog_dir, struct iolog_details *details)
 {
     struct iolog_info iolog_info;
-    debug_decl(write_info_log, SUDOERS_DEBUG_UTIL)
+    debug_decl(write_info_log, SUDOERS_DEBUG_UTIL);
 
     /* XXX - just use iolog_info in the first place? */
     memset(&iolog_info, 0, sizeof(iolog_info));
@@ -495,7 +495,7 @@ copy_vector_shallow(char * const *vec)
 {
     char **copy;
     size_t len;
-    debug_decl(copy_vector, SUDOERS_DEBUG_UTIL)
+    debug_decl(copy_vector, SUDOERS_DEBUG_UTIL);
 
     for (len = 0; vec[len] != NULL; len++)
 	continue;
@@ -516,7 +516,7 @@ sudoers_io_open_local(void)
     size_t len;
     int iolog_dir_fd = -1;
     int i, ret = -1;
-    debug_decl(sudoers_io_open_local, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_open_local, SUDOERS_DEBUG_PLUGIN);
 
     /* If no I/O log path defined we need to figure it out ourselves. */
     if (iolog_details.iolog_path == NULL) {
@@ -586,7 +586,7 @@ static int
 sudoers_io_open_remote(void)
 {
     int sock, ret = -1;
-    debug_decl(sudoers_io_open_remote, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_open_remote, SUDOERS_DEBUG_PLUGIN);
 
     /* Connect to log server. */
     sock = log_server_connect(iolog_details.log_servers,
@@ -623,7 +623,7 @@ sudoers_io_open(unsigned int version, sudo_conv_t conversation,
     char * const *cur;
     const char *cp, *plugin_path = NULL;
     int ret = -1;
-    debug_decl(sudoers_io_open, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_open, SUDOERS_DEBUG_PLUGIN);
 
     sudo_conv = conversation;
     sudo_printf = plugin_printf;
@@ -724,7 +724,7 @@ sudoers_io_close(int exit_status, int error)
 {
     const char *errstr = NULL;
     int i;
-    debug_decl(sudoers_io_close, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_close, SUDOERS_DEBUG_PLUGIN);
 
     if (iolog_remote) {
 	client_close(&client_closure, exit_status, error);
@@ -754,7 +754,7 @@ sudoers_io_close(int exit_status, int error)
 static int
 sudoers_io_version(int verbose)
 {
-    debug_decl(sudoers_io_version, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_version, SUDOERS_DEBUG_PLUGIN);
 
     sudo_printf(SUDO_CONV_INFO_MSG, "Sudoers I/O plugin version %s\n",
 	PACKAGE_VERSION);
@@ -774,7 +774,7 @@ sudoers_io_log_local(int event, const char *buf, unsigned int len,
     struct iolog_file *iol;
     char tbuf[1024];
     int ret = -1;
-    debug_decl(sudoers_io_log_local, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_log_local, SUDOERS_DEBUG_PLUGIN);
 
     if (event < 0 || event >= IOFD_MAX) {
 	*errstr = NULL;
@@ -821,7 +821,7 @@ sudoers_io_log_remote(int event, const char *buf, unsigned int len,
     struct timespec *delay, const char **errstr)
 {
     int type, ret = -1;
-    debug_decl(sudoers_io_log_remote, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_log_remote, SUDOERS_DEBUG_PLUGIN);
 
     if (client_closure.disabled)
 	debug_return_int(1);
@@ -870,7 +870,7 @@ sudoers_io_log(const char *buf, unsigned int len, int event)
     struct timespec now, delay;
     const char *errstr = NULL;
     int ret = -1;
-    debug_decl(sudoers_io_log, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_log, SUDOERS_DEBUG_PLUGIN);
 
     if (sudo_gettime_awake(&now) == -1) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
@@ -941,7 +941,7 @@ sudoers_io_change_winsize_local(unsigned int lines, unsigned int cols,
 {
     char tbuf[1024];
     int len, ret = -1;
-    debug_decl(sudoers_io_change_winsize_local, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_change_winsize_local, SUDOERS_DEBUG_PLUGIN);
 
     /* Write window change event to the timing file. */
     len = snprintf(tbuf, sizeof(tbuf), "%d %lld.%09ld %u %u\n",
@@ -967,7 +967,7 @@ sudoers_io_change_winsize_remote(unsigned int lines, unsigned int cols,
     struct timespec *delay, const char **errstr)
 {
     int ret = -1;
-    debug_decl(sudoers_io_change_winsize_remote, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_change_winsize_remote, SUDOERS_DEBUG_PLUGIN);
 
     if (client_closure.disabled)
 	debug_return_int(1);
@@ -991,7 +991,7 @@ sudoers_io_change_winsize(unsigned int lines, unsigned int cols)
     struct timespec now, delay;
     const char *errstr = NULL;
     int ret = -1;
-    debug_decl(sudoers_io_change_winsize, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_change_winsize, SUDOERS_DEBUG_PLUGIN);
 
     if (sudo_gettime_awake(&now) == -1) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO,
@@ -1033,7 +1033,7 @@ sudoers_io_suspend_local(const char *signame, struct timespec *delay,
     unsigned int len;
     char tbuf[1024];
     int ret = -1;
-    debug_decl(sudoers_io_suspend_local, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_suspend_local, SUDOERS_DEBUG_PLUGIN);
 
     /* Write suspend event to the timing file. */
     len = (unsigned int)snprintf(tbuf, sizeof(tbuf), "%d %lld.%09ld %s\n",
@@ -1058,7 +1058,7 @@ sudoers_io_suspend_remote(const char *signame, struct timespec *delay,
     const char **errstr)
 {
     int ret = -1;
-    debug_decl(sudoers_io_suspend_remote, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_suspend_remote, SUDOERS_DEBUG_PLUGIN);
 
     if (client_closure.disabled)
 	debug_return_int(1);
@@ -1083,7 +1083,7 @@ sudoers_io_suspend(int signo)
     char signame[SIG2STR_MAX];
     const char *errstr = NULL;
     int ret = -1;
-    debug_decl(sudoers_io_suspend, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_io_suspend, SUDOERS_DEBUG_PLUGIN);
 
     if (signo <= 0 || sig2str(signo, signame) == -1) {
 	sudo_warnx(U_("%s: internal error, invalid signal %d"),
diff --git a/plugins/sudoers/iolog_client.c b/plugins/sudoers/iolog_client.c
index 32e38ceea..51648125b 100644
--- a/plugins/sudoers/iolog_client.c
+++ b/plugins/sudoers/iolog_client.c
@@ -63,7 +63,7 @@ connect_cb(int sock, int what, void *v)
 {
     int optval, ret, *errnump = v;
     socklen_t optlen = sizeof(optval);
-    debug_decl(connect_cb, SUDOERS_DEBUG_UTIL)
+    debug_decl(connect_cb, SUDOERS_DEBUG_UTIL);
 
     if (what == SUDO_PLUGIN_EV_TIMEOUT) {
 	*errnump = ETIMEDOUT;
@@ -85,7 +85,7 @@ timed_connect(int sock, const struct sockaddr *addr, socklen_t addrlen,
     struct sudo_event_base *evbase = NULL;
     struct sudo_event *connect_event = NULL;
     int ret, errnum = 0;
-    debug_decl(timed_connect, SUDOERS_DEBUG_UTIL)
+    debug_decl(timed_connect, SUDOERS_DEBUG_UTIL);
 
     ret = connect(sock, addr, addrlen);
     if (ret == -1 && errno == EINPROGRESS) {
@@ -129,7 +129,7 @@ connect_server(const char *host, const char *port, struct timespec *timo,
     struct addrinfo hints, *res, *res0;
     const char *cause = NULL;
     int error, sock = -1;
-    debug_decl(connect_server, SUDOERS_DEBUG_UTIL)
+    debug_decl(connect_server, SUDOERS_DEBUG_UTIL);
 
     memset(&hints, 0, sizeof(hints));
     hints.ai_family = AF_UNSPEC;
@@ -187,7 +187,7 @@ log_server_connect(struct sudoers_str_list *servers, struct timespec *timo)
     char *copy, *host, *port;
     const char *cause = NULL;
     int sock = -1;
-    debug_decl(restore_nproc, SUDOERS_DEBUG_UTIL)
+    debug_decl(restore_nproc, SUDOERS_DEBUG_UTIL);
 
     STAILQ_FOREACH(server, servers, entries) {
 	copy = strdup(server->str);
@@ -217,7 +217,7 @@ log_server_connect(struct sudoers_str_list *servers, struct timespec *timo)
 static bool
 tls_init(struct client_closure *closure, bool peer_auth)
 {
-    debug_decl(tls_init, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(tls_init, SUDOERS_DEBUG_PLUGIN);
 
     if (closure->log_details->ca_bundle == NULL) {
         sudo_warnx(U_("CA bundle file is not set in sudoers"));
@@ -301,7 +301,7 @@ tls_connect_cb(int sock, int what, void *v)
     struct timespec timeo = { 10, 0 };
     int tls_con, err;
 
-    debug_decl(tls_connect_cb, SUDO_DEBUG_UTIL)
+    debug_decl(tls_connect_cb, SUDO_DEBUG_UTIL);
 
     if (what == SUDO_PLUGIN_EV_TIMEOUT) {
         sudo_warnx(U_("TLS handshake timeout occured"));
@@ -342,7 +342,7 @@ tls_timed_connect(struct client_closure *closure)
 {
     struct sudo_event_base *evbase = NULL;
 
-    debug_decl(tls_timed_connect, SUDO_DEBUG_UTIL)
+    debug_decl(tls_timed_connect, SUDO_DEBUG_UTIL);
 
 	evbase = sudo_ev_base_alloc();
     closure->tls_conn_status = false;
@@ -380,7 +380,7 @@ void
 client_closure_free(struct client_closure *closure)
 {
     struct connection_buffer *buf;
-    debug_decl(client_closure_free, SUDOERS_DEBUG_UTIL)
+    debug_decl(client_closure_free, SUDOERS_DEBUG_UTIL);
 
     if (closure->sock != -1) {
 	close(closure->sock);
@@ -431,7 +431,7 @@ static struct connection_buffer *
 get_free_buf(struct client_closure *closure)
 {
     struct connection_buffer *buf;
-    debug_decl(get_free_buf, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_free_buf, SUDOERS_DEBUG_UTIL);
 
     buf = TAILQ_FIRST(&closure->free_bufs);
     if (buf != NULL)
@@ -454,7 +454,7 @@ fmt_client_message(struct client_closure *closure, ClientMessage *msg)
     uint32_t msg_len;
     bool ret = false;
     size_t len;
-    debug_decl(fmt_client_message, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_client_message, SUDOERS_DEBUG_UTIL);
 
     if ((buf = get_free_buf(closure)) == NULL) {
 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
@@ -514,7 +514,7 @@ fmt_accept_message(struct client_closure *closure)
     size_t info_msgs_size, n;
     struct timespec now;
     bool ret = false;
-    debug_decl(fmt_accept_message, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_accept_message, SUDOERS_DEBUG_UTIL);
 
     /*
      * Fill in AcceptMessage and add it to ClientMessage.
@@ -671,7 +671,7 @@ fmt_restart_message(struct client_closure *closure)
     RestartMessage restart_msg = RESTART_MESSAGE__INIT;
     TimeSpec tv = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_restart_message, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_restart_message, SUDOERS_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO,
 	"%s: sending RestartMessage, [%lld, %ld]", __func__,
@@ -705,7 +705,7 @@ fmt_exit_message(struct client_closure *closure, int exit_status, int error)
     char signame[SIG2STR_MAX];
     bool ret = false;
     struct timespec run_time;
-    debug_decl(fmt_exit_message, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_exit_message, SUDOERS_DEBUG_UTIL);
 
     if (sudo_gettime_awake(&run_time) == -1) {
 	sudo_warn("%s", U_("unable to get time of day"));
@@ -773,7 +773,7 @@ fmt_io_buf(struct client_closure *closure, int type, const char *buf,
     IoBuffer iobuf_msg = IO_BUFFER__INIT;
     TimeSpec ts = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_io_buf, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_io_buf, SUDOERS_DEBUG_UTIL);
 
     /* Fill in IoBuffer. */
     ts.tv_sec = delay->tv_sec;
@@ -811,7 +811,7 @@ fmt_winsize(struct client_closure *closure, unsigned int lines,
     ChangeWindowSize winsize_msg = CHANGE_WINDOW_SIZE__INIT;
     TimeSpec ts = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_winsize, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_winsize, SUDOERS_DEBUG_UTIL);
 
     /* Fill in ChangeWindowSize message. */
     ts.tv_sec = delay->tv_sec;
@@ -847,7 +847,7 @@ fmt_suspend(struct client_closure *closure, const char *signame, struct timespec
     CommandSuspend suspend_msg = COMMAND_SUSPEND__INIT;
     TimeSpec ts = TIME_SPEC__INIT;
     bool ret = false;
-    debug_decl(fmt_suspend, SUDOERS_DEBUG_UTIL)
+    debug_decl(fmt_suspend, SUDOERS_DEBUG_UTIL);
 
     /* Fill in CommandSuspend message. */
     ts.tv_sec = delay->tv_sec;
@@ -878,7 +878,7 @@ done:
 static bool
 client_message_completion(struct client_closure *closure)
 {
-    debug_decl(client_message_completion, SUDOERS_DEBUG_UTIL)
+    debug_decl(client_message_completion, SUDOERS_DEBUG_UTIL);
 
     switch (closure->state) {
     case SEND_ACCEPT:
@@ -915,7 +915,7 @@ static bool
 handle_server_hello(ServerHello *msg, struct client_closure *closure)
 {
     size_t n;
-    debug_decl(handle_server_hello, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_server_hello, SUDOERS_DEBUG_UTIL);
 
     if (closure->state != RECV_HELLO) {
 	sudo_warnx(U_("%s: unexpected state %d"), __func__, closure->state);
@@ -973,7 +973,7 @@ handle_server_hello(ServerHello *msg, struct client_closure *closure)
 static bool
 handle_commit_point(TimeSpec *commit_point, struct client_closure *closure)
 {
-    debug_decl(handle_commit_point, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_commit_point, SUDOERS_DEBUG_UTIL);
 
     /* Only valid after we have sent an IO buffer. */
     if (closure->state < SEND_IO) {
@@ -1004,7 +1004,7 @@ handle_commit_point(TimeSpec *commit_point, struct client_closure *closure)
 static bool
 handle_log_id(char *id, struct client_closure *closure)
 {
-    debug_decl(handle_log_id, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_log_id, SUDOERS_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: remote log ID: %s", __func__, id);
     if ((closure->iolog_id = strdup(id)) == NULL)
@@ -1019,7 +1019,7 @@ handle_log_id(char *id, struct client_closure *closure)
 static bool
 handle_server_error(char *errmsg, struct client_closure *closure)
 {
-    debug_decl(handle_server_error, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_server_error, SUDOERS_DEBUG_UTIL);
 
     sudo_warnx(U_("error message received from server: %s"), errmsg);
     debug_return_bool(false);
@@ -1032,7 +1032,7 @@ handle_server_error(char *errmsg, struct client_closure *closure)
 static bool
 handle_server_abort(char *errmsg, struct client_closure *closure)
 {
-    debug_decl(handle_server_abort, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_server_abort, SUDOERS_DEBUG_UTIL);
 
     sudo_warnx(U_("abort message received from server: %s"), errmsg);
     debug_return_bool(false);
@@ -1048,7 +1048,7 @@ handle_server_message(uint8_t *buf, size_t len,
 {
     ServerMessage *msg;
     bool ret = false;
-    debug_decl(handle_server_message, SUDOERS_DEBUG_UTIL)
+    debug_decl(handle_server_message, SUDOERS_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_INFO, "%s: unpacking ServerMessage", __func__);
     msg = server_message__unpack(NULL, len, buf);
@@ -1103,7 +1103,7 @@ static bool
 expand_buf(struct connection_buffer *buf, unsigned int needed)
 {
     void *newdata;
-    debug_decl(expand_buf, SUDO_DEBUG_UTIL)
+    debug_decl(expand_buf, SUDO_DEBUG_UTIL);
 
     if (buf->size < needed) {
 	/* Expand buffer. */
@@ -1140,7 +1140,7 @@ server_msg_cb(int fd, int what, void *v)
     struct connection_buffer *buf = &closure->read_buf;
     ssize_t nread;
     uint32_t msg_len;
-    debug_decl(server_msg_cb, SUDOERS_DEBUG_UTIL)
+    debug_decl(server_msg_cb, SUDOERS_DEBUG_UTIL);
 
     if (what == SUDO_PLUGIN_EV_TIMEOUT) {
 	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: timed out reading from server",
@@ -1245,7 +1245,7 @@ client_msg_cb(int fd, int what, void *v)
     struct client_closure *closure = v;
     struct connection_buffer *buf;
     ssize_t nwritten;
-    debug_decl(client_msg_cb, SUDOERS_DEBUG_UTIL)
+    debug_decl(client_msg_cb, SUDOERS_DEBUG_UTIL);
 
     if (what == SUDO_PLUGIN_EV_TIMEOUT) {
 	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: timed out writiing to server",
@@ -1336,7 +1336,7 @@ bool
 client_closure_fill(struct client_closure *closure, int sock,
     struct iolog_details *details, struct io_plugin *sudoers_io)
 {
-    debug_decl(client_closure_alloc, SUDOERS_DEBUG_UTIL)
+    debug_decl(client_closure_alloc, SUDOERS_DEBUG_UTIL);
 
     closure->sock = -1;
     closure->state = RECV_HELLO;
@@ -1398,7 +1398,7 @@ client_close(struct client_closure *closure, int exit_status, int error)
     struct sudo_event_base *evbase = NULL;
     short events;
     bool ret = false;
-    debug_decl(client_close, SUDOERS_DEBUG_UTIL)
+    debug_decl(client_close, SUDOERS_DEBUG_UTIL);
 
     if (closure->disabled)
 	goto done;
diff --git a/plugins/sudoers/iolog_path_escapes.c b/plugins/sudoers/iolog_path_escapes.c
index 0f816a7f4..7daf6808b 100644
--- a/plugins/sudoers/iolog_path_escapes.c
+++ b/plugins/sudoers/iolog_path_escapes.c
@@ -45,13 +45,13 @@ static size_t
 fill_seq(char *str, size_t strsize, void *v)
 {
 #ifdef SUDOERS_NO_SEQ
-    debug_decl(fill_seq, SUDO_DEBUG_UTIL)
+    debug_decl(fill_seq, SUDO_DEBUG_UTIL);
     debug_return_size_t(strlcpy(str, "%{seq}", strsize));
 #else
     char *logdir = v;
     static char sessid[7];
     int len;
-    debug_decl(fill_seq, SUDO_DEBUG_UTIL)
+    debug_decl(fill_seq, SUDO_DEBUG_UTIL);
 
     if (sessid[0] == '\0') {
 	if (!iolog_nextid(logdir, sessid))
@@ -70,7 +70,7 @@ fill_seq(char *str, size_t strsize, void *v)
 static size_t
 fill_user(char *str, size_t strsize, void *unused)
 {
-    debug_decl(fill_user, SUDO_DEBUG_UTIL)
+    debug_decl(fill_user, SUDO_DEBUG_UTIL);
     debug_return_size_t(strlcpy(str, user_name, strsize));
 }
 
@@ -79,7 +79,7 @@ fill_group(char *str, size_t strsize, void *unused)
 {
     struct group *grp;
     size_t len;
-    debug_decl(fill_group, SUDO_DEBUG_UTIL)
+    debug_decl(fill_group, SUDO_DEBUG_UTIL);
 
     if ((grp = sudo_getgrgid(user_gid)) != NULL) {
 	len = strlcpy(str, grp->gr_name, strsize);
@@ -95,7 +95,7 @@ fill_group(char *str, size_t strsize, void *unused)
 static size_t
 fill_runas_user(char *str, size_t strsize, void *unused)
 {
-    debug_decl(fill_runas_user, SUDO_DEBUG_UTIL)
+    debug_decl(fill_runas_user, SUDO_DEBUG_UTIL);
     debug_return_size_t(strlcpy(str, runas_pw->pw_name, strsize));
 }
 
@@ -104,7 +104,7 @@ fill_runas_group(char *str, size_t strsize, void *unused)
 {
     struct group *grp;
     size_t len;
-    debug_decl(fill_runas_group, SUDO_DEBUG_UTIL)
+    debug_decl(fill_runas_group, SUDO_DEBUG_UTIL);
 
     if (runas_gr != NULL) {
 	len = strlcpy(str, runas_gr->gr_name, strsize);
@@ -124,14 +124,14 @@ fill_runas_group(char *str, size_t strsize, void *unused)
 static size_t
 fill_hostname(char *str, size_t strsize, void *unused)
 {
-    debug_decl(fill_hostname, SUDO_DEBUG_UTIL)
+    debug_decl(fill_hostname, SUDO_DEBUG_UTIL);
     debug_return_size_t(strlcpy(str, user_shost, strsize));
 }
 
 static size_t
 fill_command(char *str, size_t strsize, void *unused)
 {
-    debug_decl(fill_command, SUDO_DEBUG_UTIL)
+    debug_decl(fill_command, SUDO_DEBUG_UTIL);
     debug_return_size_t(strlcpy(str, user_base, strsize));
 }
 
diff --git a/plugins/sudoers/ldap.c b/plugins/sudoers/ldap.c
index 583af5dcf..e4cf5adaf 100644
--- a/plugins/sudoers/ldap.c
+++ b/plugins/sudoers/ldap.c
@@ -170,7 +170,7 @@ sudo_ldap_join_uri(struct ldap_config_str_list *uri_list)
     struct ldap_config_str *uri;
     size_t len = 0;
     char *buf = NULL;
-    debug_decl(sudo_ldap_join_uri, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_join_uri, SUDOERS_DEBUG_LDAP);
 
     STAILQ_FOREACH(uri, uri_list, entries) {
 	if (ldap_conf.ssl_mode == SUDO_LDAP_STARTTLS) {
@@ -206,7 +206,7 @@ sudo_ldap_init(LDAP **ldp, const char *host, int port)
 {
     LDAP *ld;
     int ret = LDAP_CONNECT_ERROR;
-    debug_decl(sudo_ldap_init, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_init, SUDOERS_DEBUG_LDAP);
 
 #ifdef HAVE_LDAPSSL_INIT
     if (ldap_conf.ssl_mode != SUDO_LDAP_CLEAR) {
@@ -324,7 +324,7 @@ sudo_ldap_check_non_unix_group(LDAP *ld, LDAPMessage *entry, struct passwd *pw)
     bool ret = false;
     char *val;
     int rc;
-    debug_decl(sudo_ldap_check_non_unix_group, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_check_non_unix_group, SUDOERS_DEBUG_LDAP);
 
     if (!entry)
 	debug_return_bool(ret);
@@ -368,7 +368,7 @@ sudo_ldap_get_first_rdn(LDAP *ld, LDAPMessage *entry)
 #ifdef HAVE_LDAP_STR2DN
     char *dn, *rdn = NULL;
     LDAPDN tmpDN;
-    debug_decl(sudo_ldap_get_first_rdn, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_get_first_rdn, SUDOERS_DEBUG_LDAP);
 
     if ((dn = ldap_get_dn(ld, entry)) == NULL)
 	debug_return_str(NULL);
@@ -380,7 +380,7 @@ sudo_ldap_get_first_rdn(LDAP *ld, LDAPMessage *entry)
     debug_return_str(rdn);
 #else
     char *dn, **edn;
-    debug_decl(sudo_ldap_get_first_rdn, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_get_first_rdn, SUDOERS_DEBUG_LDAP);
 
     if ((dn = ldap_get_dn(ld, entry)) == NULL)
 	debug_return_str(NULL);
@@ -401,7 +401,7 @@ sudo_ldap_parse_options(LDAP *ld, LDAPMessage *entry, struct defaults_list *defs
     char *cn, *cp, *source = NULL;
     bool ret = false;
     int rc;
-    debug_decl(sudo_ldap_parse_options, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_parse_options, SUDOERS_DEBUG_LDAP);
 
     bv = sudo_ldap_get_values_len(ld, entry, "sudoOption", &rc);
     if (bv == NULL) {
@@ -474,7 +474,7 @@ sudo_ldap_timefilter(char *buffer, size_t buffersize)
     time_t now;
     char timebuffer[sizeof("20120727121554.0Z")];
     int len = -1;
-    debug_decl(sudo_ldap_timefilter, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_timefilter, SUDOERS_DEBUG_LDAP);
 
     /* Make sure we have a formatted timestamp for __now__. */
     time(&now);
@@ -509,7 +509,7 @@ static char *
 sudo_ldap_build_default_filter(void)
 {
     char *filt;
-    debug_decl(sudo_ldap_build_default_filter, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_build_default_filter, SUDOERS_DEBUG_LDAP);
 
     if (!ldap_conf.search_filter)
 	debug_return_str(strdup("cn=defaults"));
@@ -910,7 +910,7 @@ sudo_ldap_build_pass1(LDAP *ld, struct passwd *pw)
     struct group *grp;
     size_t sz = 0;
     int i;
-    debug_decl(sudo_ldap_build_pass1, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_build_pass1, SUDOERS_DEBUG_LDAP);
 
     STAILQ_INIT(&netgroups);
 
@@ -1084,7 +1084,7 @@ sudo_ldap_build_pass2(void)
     char *filt, timebuffer[TIMEFILTER_LENGTH + 1];
     bool query_netgroups = def_use_netgroups;
     int len;
-    debug_decl(sudo_ldap_build_pass2, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_build_pass2, SUDOERS_DEBUG_LDAP);
 
     /* No need to query netgroups if using netgroup_base. */
     if (!STAILQ_EMPTY(&ldap_conf.netgroup_base))
@@ -1141,7 +1141,7 @@ ldap_to_sudoers(LDAP *ld, struct ldap_result *lres,
     struct member *m;
     unsigned int i;
     int rc;
-    debug_decl(ldap_to_sudoers, SUDOERS_DEBUG_LDAP)
+    debug_decl(ldap_to_sudoers, SUDOERS_DEBUG_LDAP);
 
     /* We only have a single userspec */
     if ((us = calloc(1, sizeof(*us))) == NULL)
@@ -1253,7 +1253,7 @@ sudo_set_krb5_ccache_name(const char *name, const char **old_name)
     int ret = 0;
     unsigned int junk;
     static bool initialized;
-    debug_decl(sudo_set_krb5_ccache_name, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_set_krb5_ccache_name, SUDOERS_DEBUG_LDAP);
 
     if (!initialized) {
 	sudo_gss_krb5_ccache_name = (sudo_gss_krb5_ccache_name_t)
@@ -1296,7 +1296,7 @@ sudo_krb5_copy_cc_file(const char *old_ccname)
     ssize_t nread, nwritten = -1;
     static char new_ccname[sizeof(_PATH_TMP) + sizeof("sudocc_XXXXXXXX") - 1];
     char buf[10240], *ret = NULL;
-    debug_decl(sudo_krb5_copy_cc_file, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_krb5_copy_cc_file, SUDOERS_DEBUG_LDAP);
 
     old_ccname = sudo_krb5_ccname_path(old_ccname);
     if (old_ccname != NULL) {
@@ -1358,7 +1358,7 @@ sudo_ldap_sasl_interact(LDAP *ld, unsigned int flags, void *_auth_id,
     char *auth_id = (char *)_auth_id;
     sasl_interact_t *interact = (sasl_interact_t *)_interact;
     int ret = LDAP_SUCCESS;
-    debug_decl(sudo_ldap_sasl_interact, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_sasl_interact, SUDOERS_DEBUG_LDAP);
 
     for (; interact->id != SASL_CB_LIST_END; interact++) {
 	if (interact->id != SASL_CB_USER) {
@@ -1397,7 +1397,7 @@ static struct ldap_result *
 sudo_ldap_result_alloc(void)
 {
     struct ldap_result *result;
-    debug_decl(sudo_ldap_result_alloc, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_alloc, SUDOERS_DEBUG_LDAP);
 
     result = calloc(1, sizeof(*result));
     if (result != NULL)
@@ -1413,7 +1413,7 @@ static void
 sudo_ldap_result_free(struct ldap_result *lres)
 {
     struct ldap_search_result *s;
-    debug_decl(sudo_ldap_result_free, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_free, SUDOERS_DEBUG_LDAP);
 
     if (lres != NULL) {
 	if (lres->nentries) {
@@ -1438,7 +1438,7 @@ sudo_ldap_result_add_search(struct ldap_result *lres, LDAP *ldap,
     LDAPMessage *searchresult)
 {
     struct ldap_search_result *news;
-    debug_decl(sudo_ldap_result_add_search, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_add_search, SUDOERS_DEBUG_LDAP);
 
     /* Create new entry and add it to the end of the chain. */
     news = calloc(1, sizeof(*news));
@@ -1459,7 +1459,7 @@ static int
 sudo_ldap_bind_s(LDAP *ld)
 {
     int ret;
-    debug_decl(sudo_ldap_bind_s, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_bind_s, SUDOERS_DEBUG_LDAP);
 
 #ifdef HAVE_LDAP_SASL_INTERACTIVE_BIND_S
     if (ldap_conf.rootuse_sasl == true ||
@@ -1553,7 +1553,7 @@ static int
 sudo_ldap_close(struct sudo_nss *nss)
 {
     struct sudo_ldap_handle *handle = nss->handle;
-    debug_decl(sudo_ldap_close, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_close, SUDOERS_DEBUG_LDAP);
 
     if (handle != NULL) {
 	/* Unbind and close the LDAP connection. */
@@ -1583,7 +1583,7 @@ sudo_ldap_open(struct sudo_nss *nss)
     int rc = -1;
     bool ldapnoinit = false;
     struct sudo_ldap_handle *handle;
-    debug_decl(sudo_ldap_open, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_open, SUDOERS_DEBUG_LDAP);
 
     if (nss->handle != NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR,
@@ -1688,7 +1688,7 @@ sudo_ldap_getdefs(struct sudo_nss *nss)
     char *filt = NULL;
     int rc, ret = -1;
     static bool cached;
-    debug_decl(sudo_ldap_getdefs, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_getdefs, SUDOERS_DEBUG_LDAP);
 
     if (handle == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR,
@@ -1746,7 +1746,7 @@ ldap_entry_compare(const void *a, const void *b)
 {
     const struct ldap_entry_wrapper *aw = a;
     const struct ldap_entry_wrapper *bw = b;
-    debug_decl(ldap_entry_compare, SUDOERS_DEBUG_LDAP)
+    debug_decl(ldap_entry_compare, SUDOERS_DEBUG_LDAP);
 
     debug_return_int(aw->order < bw->order ? -1 :
 	(aw->order > bw->order ? 1 : 0));
@@ -1759,7 +1759,7 @@ ldap_entry_compare(const void *a, const void *b)
 static struct ldap_search_result *
 sudo_ldap_result_last_search(struct ldap_result *lres)
 {
-    debug_decl(sudo_ldap_result_last_search, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_last_search, SUDOERS_DEBUG_LDAP);
 
     debug_return_ptr(STAILQ_LAST(&lres->searches, ldap_search_result, entries));
 }
@@ -1775,7 +1775,7 @@ sudo_ldap_result_add_entry(struct ldap_result *lres, LDAPMessage *entry)
     double order = 0.0;
     char *ep;
     int rc;
-    debug_decl(sudo_ldap_result_add_entry, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_add_entry, SUDOERS_DEBUG_LDAP);
 
     /* Determine whether the entry has the sudoOrder attribute. */
     last = sudo_ldap_result_last_search(lres);
@@ -1836,7 +1836,7 @@ sudo_ldap_result_get(struct sudo_nss *nss, struct passwd *pw)
     LDAP *ld = handle->ld;
     char *filt = NULL;
     int pass, rc;
-    debug_decl(sudo_ldap_result_get, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_result_get, SUDOERS_DEBUG_LDAP);
 
     /*
      * Okay - time to search for anything that matches this user
@@ -1934,7 +1934,7 @@ sudo_ldap_query(struct sudo_nss *nss, struct passwd *pw)
     struct sudo_ldap_handle *handle = nss->handle;
     struct ldap_result *lres = NULL;
     int ret = -1;
-    debug_decl(sudo_ldap_query, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_query, SUDOERS_DEBUG_LDAP);
 
     if (handle == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR,
@@ -1986,7 +1986,7 @@ static struct sudoers_parse_tree *
 sudo_ldap_parse(struct sudo_nss *nss)
 {
     struct sudo_ldap_handle *handle = nss->handle;
-    debug_decl(sudo_ldap_parse, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_parse, SUDOERS_DEBUG_LDAP);
 
     if (handle == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR,
diff --git a/plugins/sudoers/ldap_conf.c b/plugins/sudoers/ldap_conf.c
index 52da45d60..402a51a20 100644
--- a/plugins/sudoers/ldap_conf.c
+++ b/plugins/sudoers/ldap_conf.c
@@ -197,7 +197,7 @@ sudo_ldap_conf_add_ports(void)
     char *host, *last, *port, defport[13];
     char hostbuf[LINE_MAX * 2];
     int len;
-    debug_decl(sudo_ldap_conf_add_ports, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_conf_add_ports, SUDOERS_DEBUG_LDAP);
 
     hostbuf[0] = '\0';
     len = snprintf(defport, sizeof(defport), ":%d", ldap_conf.port);
@@ -243,7 +243,7 @@ sudo_ldap_parse_uri(const struct ldap_config_str_list *uri_list)
     char *buf, hostbuf[LINE_MAX];
     int nldap = 0, nldaps = 0;
     int ret = -1;
-    debug_decl(sudo_ldap_parse_uri, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_parse_uri, SUDOERS_DEBUG_LDAP);
 
     hostbuf[0] = '\0';
     STAILQ_FOREACH(entry, uri_list, entries) {
@@ -328,7 +328,7 @@ sudo_ldap_decode_secret(const char *secret)
 {
     unsigned char *result = NULL;
     size_t len, reslen;
-    debug_decl(sudo_ldap_decode_secret, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_decode_secret, SUDOERS_DEBUG_LDAP);
 
     if (strncasecmp(secret, "base64:", sizeof("base64:") - 1) == 0) {
 	/*
@@ -360,7 +360,7 @@ sudo_ldap_read_secret(const char *path)
     char *line = NULL;
     size_t linesize = 0;
     ssize_t len;
-    debug_decl(sudo_ldap_read_secret, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_read_secret, SUDOERS_DEBUG_LDAP);
 
     if ((fp = fopen(path_ldap_secret, "r")) != NULL) {
 	len = getdelim(&line, &linesize, '\n', fp);
@@ -396,7 +396,7 @@ sudo_ldap_parse_keyword(const char *keyword, const char *value,
 {
     struct ldap_config_table *cur;
     const char *errstr;
-    debug_decl(sudo_ldap_parse_keyword, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_parse_keyword, SUDOERS_DEBUG_LDAP);
 
     /* Look up keyword in config tables */
     for (cur = table; cur->conf_str != NULL; cur++) {
@@ -478,7 +478,7 @@ const char *
 sudo_krb5_ccname_path(const char *old_ccname)
 {
     const char *ccname = old_ccname;
-    debug_decl(sudo_krb5_ccname_path, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_krb5_ccname_path, SUDOERS_DEBUG_LDAP);
 
     /* Strip off leading FILE: or WRFILE: prefix. */
     switch (ccname[0]) {
@@ -505,7 +505,7 @@ sudo_check_krb5_ccname(const char *ccname)
 {
     int fd = -1;
     const char *ccname_path;
-    debug_decl(sudo_check_krb5_ccname, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_check_krb5_ccname, SUDOERS_DEBUG_LDAP);
 
     /* Strip off prefix to get path name. */
     ccname_path = sudo_krb5_ccname_path(ccname);
@@ -535,7 +535,7 @@ sudo_ldap_read_config(void)
     struct ldap_config_str *conf_str;
     size_t linesize = 0;
     FILE *fp;
-    debug_decl(sudo_ldap_read_config, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_read_config, SUDOERS_DEBUG_LDAP);
 
     /* defaults */
     ldap_conf.version = 3;
@@ -815,7 +815,7 @@ sudo_ldap_set_options_table(LDAP *ld, struct ldap_config_table *table)
     struct ldap_config_table *cur;
     int ival, rc, errors = 0;
     char *sval;
-    debug_decl(sudo_ldap_set_options_table, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_set_options_table, SUDOERS_DEBUG_LDAP);
 
     for (cur = table; cur->conf_str != NULL; cur++) {
 	if (cur->opt_val == -1)
@@ -860,7 +860,7 @@ int
 sudo_ldap_set_options_global(void)
 {
     int ret;
-    debug_decl(sudo_ldap_set_options_global, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_set_options_global, SUDOERS_DEBUG_LDAP);
 
     /* Set ber options */
 #ifdef LBER_OPT_DEBUG_LEVEL
@@ -881,7 +881,7 @@ int
 sudo_ldap_set_options_conn(LDAP *ld)
 {
     int rc;
-    debug_decl(sudo_ldap_set_options_conn, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_set_options_conn, SUDOERS_DEBUG_LDAP);
 
     /* Parse per-connection LDAP options table. */
     rc = sudo_ldap_set_options_table(ld, ldap_conf_conn);
diff --git a/plugins/sudoers/ldap_util.c b/plugins/sudoers/ldap_util.c
index 7a62e02b8..48ea3ab30 100644
--- a/plugins/sudoers/ldap_util.c
+++ b/plugins/sudoers/ldap_util.c
@@ -56,7 +56,7 @@ sudo_ldap_is_negated(char **valp)
 {
     char *val = *valp;
     bool ret = false;
-    debug_decl(sudo_ldap_is_negated, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_is_negated, SUDOERS_DEBUG_LDAP);
 
     while (*val == '!') {
 	ret = !ret;
@@ -78,7 +78,7 @@ sudo_ldap_parse_option(char *optstr, char **varp, char **valp)
     char *cp, *val = NULL;
     char *var = optstr;
     int op;
-    debug_decl(sudo_ldap_parse_option, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_parse_option, SUDOERS_DEBUG_LDAP);
 
     /* check for equals sign past first char */
     cp = strchr(var, '=');
@@ -130,7 +130,7 @@ array_to_member_list(void *a, sudo_ldap_iter_t iter)
     struct member_list *members;
     struct member *m;
     char *val;
-    debug_decl(bv_to_member_list, SUDOERS_DEBUG_LDAP)
+    debug_decl(bv_to_member_list, SUDOERS_DEBUG_LDAP);
 
     if ((members = calloc(1, sizeof(*members))) == NULL)
 	return NULL;
@@ -199,7 +199,7 @@ is_address(char *host)
     union sudo_in_addr_un addr;
     bool ret = false;
     char *slash;
-    debug_decl(is_address, SUDOERS_DEBUG_LDAP)
+    debug_decl(is_address, SUDOERS_DEBUG_LDAP);
 
     /* Check for mask, not currently parsed. */
     if ((slash = strchr(host, '/')) != NULL)
@@ -222,7 +222,7 @@ static struct member *
 host_to_member(char *host)
 {
     struct member *m;
-    debug_decl(host_to_member, SUDOERS_DEBUG_LDAP)
+    debug_decl(host_to_member, SUDOERS_DEBUG_LDAP);
 
     if ((m = calloc(1, sizeof(*m))) == NULL)
 	goto oom;
@@ -260,7 +260,7 @@ sudo_ldap_add_default(const char *var, const char *val, int op,
     char *source, struct defaults_list *defs)
 {
     struct defaults *def;
-    debug_decl(sudo_ldap_add_default, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_add_default, SUDOERS_DEBUG_LDAP);
 
     if ((def = calloc(1, sizeof(*def))) == NULL)
 	goto oom;
@@ -304,7 +304,7 @@ sudo_ldap_role_to_priv(const char *cn, void *hosts, void *runasusers,
     struct privilege *priv;
     struct member *m;
     char *cmnd;
-    debug_decl(sudo_ldap_role_to_priv, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_role_to_priv, SUDOERS_DEBUG_LDAP);
 
     if ((priv = calloc(1, sizeof(*priv))) == NULL)
 	goto oom;
@@ -526,7 +526,7 @@ sudo_ldap_extract_digest(char **cmnd, struct command_digest *digest)
 {
     char *ep, *cp = *cmnd;
     int digest_type = SUDO_DIGEST_INVALID;
-    debug_decl(sudo_ldap_check_command, SUDOERS_DEBUG_LDAP)
+    debug_decl(sudo_ldap_check_command, SUDOERS_DEBUG_LDAP);
 
     /*
      * Check for and extract a digest prefix, e.g.
diff --git a/plugins/sudoers/linux_audit.c b/plugins/sudoers/linux_audit.c
index 22dc54de2..ed76600d3 100644
--- a/plugins/sudoers/linux_audit.c
+++ b/plugins/sudoers/linux_audit.c
@@ -46,7 +46,7 @@ static int
 linux_audit_open(void)
 {
     static int au_fd = -1;
-    debug_decl(linux_audit_open, SUDOERS_DEBUG_AUDIT)
+    debug_decl(linux_audit_open, SUDOERS_DEBUG_AUDIT);
 
     if (au_fd != -1)
 	debug_return_int(au_fd);
@@ -69,7 +69,7 @@ linux_audit_command(char *argv[], int result)
     int au_fd, rc = -1;
     char *command, *cp, **av;
     size_t size, n;
-    debug_decl(linux_audit_command, SUDOERS_DEBUG_AUDIT)
+    debug_decl(linux_audit_command, SUDOERS_DEBUG_AUDIT);
 
     /* Don't return an error if auditing is not configured. */
     if ((au_fd = linux_audit_open()) < 0)
diff --git a/plugins/sudoers/locale.c b/plugins/sudoers/locale.c
index 6bd32ca44..12d48056a 100644
--- a/plugins/sudoers/locale.c
+++ b/plugins/sudoers/locale.c
@@ -54,14 +54,14 @@ static char *sudoers_locale;
 int
 sudoers_getlocale(void)
 {
-    debug_decl(sudoers_getlocale, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_getlocale, SUDOERS_DEBUG_UTIL);
     debug_return_int(current_locale);
 }
 
 bool
 sudoers_initlocale(const char *ulocale, const char *slocale)
 {
-    debug_decl(sudoers_initlocale, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_initlocale, SUDOERS_DEBUG_UTIL);
 
     if (ulocale != NULL) {
 	free(user_locale);
@@ -88,7 +88,7 @@ bool
 sudoers_setlocale(int newlocale, int *prevlocale)
 {
     char *res = NULL;
-    debug_decl(sudoers_setlocale, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_setlocale, SUDOERS_DEBUG_UTIL);
 
     switch (newlocale) {
 	case SUDOERS_LOCALE_USER:
@@ -135,7 +135,7 @@ sudoers_setlocale(int newlocale, int *prevlocale)
 bool
 sudoers_warn_setlocale(bool restore, int *cookie)
 {
-    debug_decl(sudoers_warn_setlocale, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_warn_setlocale, SUDOERS_DEBUG_UTIL);
 
     if (restore)
 	debug_return_bool(sudoers_setlocale(*cookie, NULL));
@@ -148,7 +148,7 @@ sudoers_warn_setlocale(bool restore, int *cookie)
 bool
 sudoers_locale_callback(const union sudo_defs_val *sd_un)
 {
-    debug_decl(sudoers_locale_callback, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_locale_callback, SUDOERS_DEBUG_UTIL);
 
     if (sudoers_initlocale(NULL, sd_un->str)) {
 	if (setlocale(LC_ALL, sd_un->str) != NULL)
diff --git a/plugins/sudoers/logging.c b/plugins/sudoers/logging.c
index cfed9cdc1..32a07a9aa 100644
--- a/plugins/sudoers/logging.c
+++ b/plugins/sudoers/logging.c
@@ -85,7 +85,7 @@ mysyslog(int pri, const char *fmt, ...)
 {
     const int flags = def_syslog_pid ? LOG_PID : 0;
     va_list ap;
-    debug_decl(mysyslog, SUDOERS_DEBUG_LOGGING)
+    debug_decl(mysyslog, SUDOERS_DEBUG_LOGGING);
 
     openlog("sudo", flags, def_syslog);
     va_start(ap, fmt);
@@ -106,7 +106,7 @@ do_syslog(int pri, char *msg)
     char *p, *tmp, save;
     const char *fmt;
     int oldlocale;
-    debug_decl(do_syslog, SUDOERS_DEBUG_LOGGING)
+    debug_decl(do_syslog, SUDOERS_DEBUG_LOGGING);
 
     /* A priority of -1 corresponds to "none". */
     if (pri == -1)
@@ -164,7 +164,7 @@ do_logfile(const char *msg)
     char *full_line;
     mode_t oldmask;
     FILE *fp;
-    debug_decl(do_logfile, SUDOERS_DEBUG_LOGGING)
+    debug_decl(do_logfile, SUDOERS_DEBUG_LOGGING);
 
     sudoers_setlocale(SUDOERS_LOCALE_SUDOERS, &oldlocale);
 
@@ -241,7 +241,7 @@ log_denial(int status, bool inform_user)
     int oldlocale;
     bool uid_changed, ret = true;
     bool mailit;
-    debug_decl(log_denial, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_denial, SUDOERS_DEBUG_LOGGING);
 
     /* Handle auditing first (audit_failure() handles the locale itself). */
     if (ISSET(status, FLAG_NO_USER | FLAG_NO_HOST))
@@ -328,7 +328,7 @@ bool
 log_failure(int status, int flags)
 {
     bool ret, inform_user = true;
-    debug_decl(log_failure, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_failure, SUDOERS_DEBUG_LOGGING);
 
     /* The user doesn't always get to see the log message (path info). */
     if (!ISSET(status, FLAG_NO_USER | FLAG_NO_HOST) && def_path_info &&
@@ -361,7 +361,7 @@ log_auth_failure(int status, unsigned int tries)
 {
     int flags = 0;
     bool ret = true;
-    debug_decl(log_auth_failure, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_auth_failure, SUDOERS_DEBUG_LOGGING);
 
     /* Handle auditing first. */
     audit_failure(NewArgc, NewArgv, N_("authentication failure"));
@@ -405,7 +405,7 @@ log_allowed(int status)
     int oldlocale;
     bool uid_changed, ret = true;
     bool mailit;
-    debug_decl(log_allowed, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_allowed, SUDOERS_DEBUG_LOGGING);
 
     /* Send mail based on status. */
     mailit = should_mail(status);
@@ -457,7 +457,7 @@ fmt_authfail_message(char **str, va_list ap)
     char *src, *dst0, *dst, *dst_end;
     size_t size;
     int len;
-    debug_decl(fmt_authfail_message, SUDOERS_DEBUG_LOGGING)
+    debug_decl(fmt_authfail_message, SUDOERS_DEBUG_LOGGING);
 
     if (def_authfail_message == NULL) {
 	debug_return_int(asprintf(str, ngettext("%u incorrect password attempt",
@@ -514,7 +514,7 @@ vlog_warning(int flags, int errnum, const char *fmt, va_list ap)
     bool uid_changed, ret = true;
     va_list ap2;
     int len;
-    debug_decl(vlog_warning, SUDOERS_DEBUG_LOGGING)
+    debug_decl(vlog_warning, SUDOERS_DEBUG_LOGGING);
 
     /* Need extra copy of ap for sudo_vwarn()/sudo_vwarnx() below. */
     va_copy(ap2, ap);
@@ -625,7 +625,7 @@ log_warning(int flags, const char *fmt, ...)
 {
     va_list ap;
     bool ret;
-    debug_decl(log_warning, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_warning, SUDOERS_DEBUG_LOGGING);
 
     /* Log the error. */
     va_start(ap, fmt);
@@ -640,7 +640,7 @@ log_warningx(int flags, const char *fmt, ...)
 {
     va_list ap;
     bool ret;
-    debug_decl(log_warningx, SUDOERS_DEBUG_LOGGING)
+    debug_decl(log_warningx, SUDOERS_DEBUG_LOGGING);
 
     /* Log the error. */
     va_start(ap, fmt);
@@ -655,7 +655,7 @@ gai_log_warning(int flags, int errnum, const char *fmt, ...)
 {
     va_list ap;
     bool ret;
-    debug_decl(gai_log_warning, SUDOERS_DEBUG_LOGGING)
+    debug_decl(gai_log_warning, SUDOERS_DEBUG_LOGGING);
 
     /* Log the error. */
     va_start(ap, fmt);
@@ -670,7 +670,7 @@ closefrom_nodebug(int lowfd)
 {
     unsigned char *debug_fds;
     int fd, startfd;
-    debug_decl(closefrom_nodebug, SUDOERS_DEBUG_LOGGING)
+    debug_decl(closefrom_nodebug, SUDOERS_DEBUG_LOGGING);
 
     startfd = sudo_debug_get_fds(&debug_fds) + 1;
     if (lowfd > startfd)
@@ -720,7 +720,7 @@ exec_mailer(int pipein)
 	NULL
     };
 #endif /* NO_ROOT_MAILER */
-    debug_decl(exec_mailer, SUDOERS_DEBUG_LOGGING)
+    debug_decl(exec_mailer, SUDOERS_DEBUG_LOGGING);
 
     /* Set stdin to read side of the pipe. */
     if (dup3(pipein, STDIN_FILENO, 0) == -1) {
@@ -780,7 +780,7 @@ send_mail(const char *fmt, ...)
     pid_t pid, rv;
     struct stat sb;
     va_list ap;
-    debug_decl(send_mail, SUDOERS_DEBUG_LOGGING)
+    debug_decl(send_mail, SUDOERS_DEBUG_LOGGING);
 
     /* If mailer is disabled just return. */
     if (!def_mailerpath || !def_mailto)
@@ -927,7 +927,7 @@ send_mail(const char *fmt, ...)
 static bool
 should_mail(int status)
 {
-    debug_decl(should_mail, SUDOERS_DEBUG_LOGGING)
+    debug_decl(should_mail, SUDOERS_DEBUG_LOGGING);
 
     debug_return_bool(def_mail_always || ISSET(status, VALIDATE_ERROR) ||
 	(def_mail_all_cmnds && ISSET(sudo_mode, (MODE_RUN|MODE_EDIT))) ||
@@ -964,7 +964,7 @@ new_logline(const char *message, const char *errstr)
 #endif
     const char *tsid = NULL;
     size_t len = 0;
-    debug_decl(new_logline, SUDOERS_DEBUG_LOGGING)
+    debug_decl(new_logline, SUDOERS_DEBUG_LOGGING);
 
 #ifndef SUDOERS_NO_SEQ
     /* A TSID may be a sudoers-style session ID or a free-form string. */
diff --git a/plugins/sudoers/logwrap.c b/plugins/sudoers/logwrap.c
index fcba62d3b..30542bc54 100644
--- a/plugins/sudoers/logwrap.c
+++ b/plugins/sudoers/logwrap.c
@@ -42,7 +42,7 @@ writeln_wrap(FILE *fp, char *line, size_t linelen, size_t maxlen)
     char *beg = line;
     char *end;
     int len, outlen = 0;
-    debug_decl(writeln_wrap, SUDOERS_DEBUG_LOGGING)
+    debug_decl(writeln_wrap, SUDOERS_DEBUG_LOGGING);
 
     /*
      * Print out line with word wrap around maxlen characters.
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index 20f908201..b6a6be761 100644
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -76,7 +76,7 @@ user_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
     const char *shost = parse_tree->shost ? parse_tree->shost : user_srunhost;
     int matched = UNSPEC;
     struct alias *a;
-    debug_decl(user_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(user_matches, SUDOERS_DEBUG_MATCH);
 
     switch (m->type) {
 	case ALL:
@@ -120,7 +120,7 @@ userlist_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
 {
     struct member *m;
     int matched = UNSPEC;
-    debug_decl(userlist_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(userlist_matches, SUDOERS_DEBUG_MATCH);
 
     TAILQ_FOREACH_REVERSE(m, list, member_list, entries) {
 	if ((matched = user_matches(parse_tree, pw, m)) != UNSPEC)
@@ -133,7 +133,7 @@ struct gid_list *
 runas_getgroups(void)
 {
     const struct passwd *pw;
-    debug_decl(runas_getgroups, SUDOERS_DEBUG_MATCH)
+    debug_decl(runas_getgroups, SUDOERS_DEBUG_MATCH);
 
     if (def_preserve_groups) {
 	sudo_gidlist_addref(user_gid_list);
@@ -162,7 +162,7 @@ runaslist_matches(struct sudoers_parse_tree *parse_tree,
     struct member *m;
     struct alias *a;
     int rc;
-    debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(runaslist_matches, SUDOERS_DEBUG_MATCH);
 
     if (ISSET(sudo_user.flags, RUNAS_USER_SPECIFIED) || !ISSET(sudo_user.flags, RUNAS_GROUP_SPECIFIED)) {
 	/* If no runas user or runas group listed in sudoers, use default. */
@@ -295,7 +295,7 @@ hostlist_matches_int(struct sudoers_parse_tree *parse_tree,
 {
     struct member *m;
     int matched = UNSPEC;
-    debug_decl(hostlist_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(hostlist_matches, SUDOERS_DEBUG_MATCH);
 
     TAILQ_FOREACH_REVERSE(m, list, member_list, entries) {
 	matched = host_matches(parse_tree, pw, lhost, shost, m);
@@ -329,7 +329,7 @@ host_matches(struct sudoers_parse_tree *parse_tree, const struct passwd *pw,
 {
     struct alias *a;
     int matched = UNSPEC;
-    debug_decl(host_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(host_matches, SUDOERS_DEBUG_MATCH);
 
     switch (m->type) {
 	case ALL:
@@ -374,7 +374,7 @@ cmndlist_matches(struct sudoers_parse_tree *parse_tree,
 {
     struct member *m;
     int matched = UNSPEC;
-    debug_decl(cmndlist_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(cmndlist_matches, SUDOERS_DEBUG_MATCH);
 
     TAILQ_FOREACH_REVERSE(m, list, member_list, entries) {
 	matched = cmnd_matches(parse_tree, m);
@@ -394,7 +394,7 @@ cmnd_matches(struct sudoers_parse_tree *parse_tree, const struct member *m)
     struct alias *a;
     struct sudo_command *c;
     int rc, matched = UNSPEC;
-    debug_decl(cmnd_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(cmnd_matches, SUDOERS_DEBUG_MATCH);
 
     switch (m->type) {
 	case ALL:
@@ -426,7 +426,7 @@ hostname_matches(const char *shost, const char *lhost, const char *pattern)
 {
     const char *host;
     bool rc;
-    debug_decl(hostname_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(hostname_matches, SUDOERS_DEBUG_MATCH);
 
     host = strchr(pattern, '.') != NULL ? lhost : shost;
     if (has_meta(pattern)) {
@@ -450,7 +450,7 @@ userpw_matches(const char *sudoers_user, const char *user, const struct passwd *
     const char *errstr;
     uid_t uid;
     bool rc;
-    debug_decl(userpw_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(userpw_matches, SUDOERS_DEBUG_MATCH);
 
     if (pw != NULL && *sudoers_user == '#') {
 	uid = (uid_t) sudo_strtoid(sudoers_user + 1, &errstr);
@@ -480,7 +480,7 @@ group_matches(const char *sudoers_group, const struct group *gr)
     const char *errstr;
     gid_t gid;
     bool rc;
-    debug_decl(group_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(group_matches, SUDOERS_DEBUG_MATCH);
 
     if (*sudoers_group == '#') {
 	gid = (gid_t) sudo_strtoid(sudoers_group + 1, &errstr);
@@ -509,7 +509,7 @@ usergr_matches(const char *group, const char *user, const struct passwd *pw)
 {
     bool matched = false;
     struct passwd *pw0 = NULL;
-    debug_decl(usergr_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(usergr_matches, SUDOERS_DEBUG_MATCH);
 
     /* Make sure we have a valid usergroup, sudo style */
     if (*group++ != '%') {
@@ -566,7 +566,7 @@ static bool
 valid_domain(const char *domain)
 {
     const char *cp;
-    debug_decl(valid_domain, SUDOERS_DEBUG_MATCH)
+    debug_decl(valid_domain, SUDOERS_DEBUG_MATCH);
 
     for (cp = domain; *cp != '\0'; cp++) {
 	/* Check for illegal characters, Linux may use "(none)". */
@@ -586,7 +586,7 @@ sudo_getdomainname(void)
 {
     static char *domain;
     static bool initialized;
-    debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH)
+    debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH);
 
     if (!initialized) {
 	size_t host_name_max;
@@ -624,7 +624,7 @@ sudo_getdomainname(void)
 const char *
 sudo_getdomainname(void)
 {
-    debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH)
+    debug_decl(sudo_getdomainname, SUDOERS_DEBUG_MATCH);
     debug_return_ptr(NULL);
 }
 #endif /* HAVE_GETDOMAINNAME || SI_SRPC_DOMAIN */
@@ -641,7 +641,7 @@ netgr_matches(const char *netgr, const char *lhost, const char *shost, const cha
     const char *domain;
 #endif
     bool rc = false;
-    debug_decl(netgr_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(netgr_matches, SUDOERS_DEBUG_MATCH);
 
     if (!def_use_netgroups) {
 	sudo_debug_printf(SUDO_DEBUG_INFO, "netgroups are disabled");
diff --git a/plugins/sudoers/match_addr.c b/plugins/sudoers/match_addr.c
index 8b97c688d..22b306d85 100644
--- a/plugins/sudoers/match_addr.c
+++ b/plugins/sudoers/match_addr.c
@@ -58,7 +58,7 @@ addr_matches_if(const char *n)
     unsigned int j;
 #endif
     unsigned int family;
-    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH)
+    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH);
 
 #ifdef HAVE_STRUCT_IN6_ADDR
     if (inet_pton(AF_INET6, n, &addr.ip6) == 1) {
@@ -111,7 +111,7 @@ addr_matches_if_netmask(const char *n, const char *m)
 #endif
     unsigned int family;
     const char *errstr;
-    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH)
+    debug_decl(addr_matches_if, SUDOERS_DEBUG_MATCH);
 
 #ifdef HAVE_STRUCT_IN6_ADDR
     if (inet_pton(AF_INET6, n, &addr.ip6) == 1)
@@ -197,7 +197,7 @@ addr_matches(char *n)
 {
     char *m;
     bool rc;
-    debug_decl(addr_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(addr_matches, SUDOERS_DEBUG_MATCH);
 
     /* If there's an explicit netmask, use it. */
     if ((m = strchr(n, '/'))) {
diff --git a/plugins/sudoers/match_command.c b/plugins/sudoers/match_command.c
index a92d5fcbe..6982c651c 100644
--- a/plugins/sudoers/match_command.c
+++ b/plugins/sudoers/match_command.c
@@ -65,7 +65,7 @@ static bool
 command_args_match(const char *sudoers_cmnd, const char *sudoers_args)
 {
     int flags = 0;
-    debug_decl(command_args_match, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_args_match, SUDOERS_DEBUG_MATCH);
 
     /*
      * If no args specified in sudoers, any user args are allowed.
@@ -93,7 +93,7 @@ command_args_match(const char *sudoers_cmnd, const char *sudoers_args)
 static bool
 do_stat(int fd, const char *path, struct stat *sb)
 {
-    debug_decl(do_stat, SUDOERS_DEBUG_MATCH)
+    debug_decl(do_stat, SUDOERS_DEBUG_MATCH);
 
     if (fd != -1)
 	debug_return_bool(fstat(fd, sb) == 0);
@@ -108,7 +108,7 @@ is_script(int fd)
 {
     bool ret = false;
     char magic[2];
-    debug_decl(is_script, SUDOERS_DEBUG_MATCH)
+    debug_decl(is_script, SUDOERS_DEBUG_MATCH);
 
     if (read(fd, magic, 2) == 2) {
 	if (magic[0] == '#' && magic[1] == '!')
@@ -129,7 +129,7 @@ static bool
 open_cmnd(const char *path, const struct command_digest *digest, int *fdp)
 {
     int fd = -1;
-    debug_decl(open_cmnd, SUDOERS_DEBUG_MATCH)
+    debug_decl(open_cmnd, SUDOERS_DEBUG_MATCH);
 
     /* Only open the file for fdexec or for digest matching. */
     if (def_fdexec != always && digest == NULL)
@@ -155,7 +155,7 @@ open_cmnd(const char *path, const struct command_digest *digest, int *fdp)
 static void
 set_cmnd_fd(int fd)
 {
-    debug_decl(set_cmnd_fd, SUDOERS_DEBUG_MATCH)
+    debug_decl(set_cmnd_fd, SUDOERS_DEBUG_MATCH);
 
     if (cmnd_fd != -1)
 	close(cmnd_fd);
@@ -204,7 +204,7 @@ command_matches_dir(const char *sudoers_dir, size_t dlen,
     char buf[PATH_MAX];
     int fd = -1;
     DIR *dirp;
-    debug_decl(command_matches_dir, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_matches_dir, SUDOERS_DEBUG_MATCH);
 
     /*
      * Grot through directory entries, looking for user_base.
@@ -269,7 +269,7 @@ command_matches_fnmatch(const char *sudoers_cmnd, const char *sudoers_args,
 {
     struct stat sb; /* XXX - unused */
     int fd = -1;
-    debug_decl(command_matches_fnmatch, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_matches_fnmatch, SUDOERS_DEBUG_MATCH);
 
     /*
      * Return true if fnmatch(3) succeeds AND
@@ -313,7 +313,7 @@ command_matches_glob(const char *sudoers_cmnd, const char *sudoers_args,
     int fd = -1;
     size_t dlen;
     glob_t gl;
-    debug_decl(command_matches_glob, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_matches_glob, SUDOERS_DEBUG_MATCH);
 
     /*
      * First check to see if we can avoid the call to glob(3).
@@ -439,7 +439,7 @@ command_matches_normal(const char *sudoers_cmnd, const char *sudoers_args, const
     const char *base;
     size_t dlen;
     int fd = -1;
-    debug_decl(command_matches_normal, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_matches_normal, SUDOERS_DEBUG_MATCH);
 
     /* If it ends in '/' it is a directory spec. */
     dlen = strlen(sudoers_cmnd);
@@ -501,7 +501,7 @@ bool
 command_matches(const char *sudoers_cmnd, const char *sudoers_args, const struct command_digest *digest)
 {
     bool rc = false;
-    debug_decl(command_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(command_matches, SUDOERS_DEBUG_MATCH);
 
     /* Check for pseudo-commands */
     if (sudoers_cmnd[0] != '/') {
diff --git a/plugins/sudoers/match_digest.c b/plugins/sudoers/match_digest.c
index a531185ee..0b220d7ff 100644
--- a/plugins/sudoers/match_digest.c
+++ b/plugins/sudoers/match_digest.c
@@ -50,7 +50,7 @@ digest_matches(int fd, const char *file, const struct command_digest *digest)
     unsigned char *sudoers_digest = NULL;
     bool matched = false;
     size_t digest_len;
-    debug_decl(digest_matches, SUDOERS_DEBUG_MATCH)
+    debug_decl(digest_matches, SUDOERS_DEBUG_MATCH);
 
     if (fd == -1)
 	goto done;
diff --git a/plugins/sudoers/parse.c b/plugins/sudoers/parse.c
index 2853093df..dca3304ec 100644
--- a/plugins/sudoers/parse.c
+++ b/plugins/sudoers/parse.c
@@ -59,7 +59,7 @@ sudoers_lookup_pseudo(struct sudo_nss_list *snl, struct passwd *pw,
     struct defaults *def;
     int nopass;
     enum def_tuple pwcheck;
-    debug_decl(sudoers_lookup_pseudo, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudoers_lookup_pseudo, SUDOERS_DEBUG_PARSER);
 
     pwcheck = (pwflag == -1) ? never : sudo_defs_table[pwflag].sd_un.tuple;
     nopass = (pwcheck == never || pwcheck == all) ? true : false;
@@ -128,7 +128,7 @@ sudoers_lookup_check(struct sudo_nss *nss, struct passwd *pw,
     struct privilege *priv;
     struct userspec *us;
     struct member *matching_user;
-    debug_decl(sudoers_lookup_check, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudoers_lookup_check, SUDOERS_DEBUG_PARSER);
 
     TAILQ_FOREACH_REVERSE(us, &nss->parse_tree->userspecs, userspec_list, entries) {
 	if (userlist_matches(nss->parse_tree, pw, &us->users) != ALLOW)
@@ -187,7 +187,7 @@ sudoers_lookup_check(struct sudo_nss *nss, struct passwd *pw,
 static bool
 apply_cmndspec(struct cmndspec *cs)
 {
-    debug_decl(apply_cmndspec, SUDOERS_DEBUG_PARSER)
+    debug_decl(apply_cmndspec, SUDOERS_DEBUG_PARSER);
 
     if (cs != NULL) {
 #ifdef HAVE_SELINUX
@@ -286,7 +286,7 @@ sudoers_lookup(struct sudo_nss_list *snl, struct passwd *pw, int validated,
     struct sudo_nss *nss;
     int m, match = UNSPEC;
     time_t now;
-    debug_decl(sudoers_lookup, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudoers_lookup, SUDOERS_DEBUG_PARSER);
 
     /*
      * Special case checking the "validate", "list" and "kill" pseudo-commands.
@@ -337,7 +337,7 @@ display_priv_short(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
 {
     struct privilege *priv;
     int nfound = 0;
-    debug_decl(display_priv_short, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_priv_short, SUDOERS_DEBUG_PARSER);
 
     TAILQ_FOREACH(priv, &us->privileges, entries) {
 	struct cmndspec *cs, *prev_cs = NULL;
@@ -397,7 +397,7 @@ display_priv_short(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
 static bool
 new_long_entry(struct cmndspec *cs, struct cmndspec *prev_cs)
 {
-    debug_decl(new_long_entry, SUDOERS_DEBUG_PARSER)
+    debug_decl(new_long_entry, SUDOERS_DEBUG_PARSER);
 
     if (prev_cs == NULL)
 	debug_return_bool(true);
@@ -430,7 +430,7 @@ display_priv_long(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
 {
     struct privilege *priv;
     int nfound = 0;
-    debug_decl(display_priv_long, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_priv_long, SUDOERS_DEBUG_PARSER);
 
     TAILQ_FOREACH(priv, &us->privileges, entries) {
 	struct cmndspec *cs, *prev_cs;
@@ -545,7 +545,7 @@ sudo_display_userspecs(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
 {
     struct userspec *us;
     int nfound = 0;
-    debug_decl(sudo_display_userspecs, SUDOERS_DEBUG_PARSER)
+    debug_decl(sudo_display_userspecs, SUDOERS_DEBUG_PARSER);
 
     TAILQ_FOREACH(us, &parse_tree->userspecs, entries) {
 	if (userlist_matches(parse_tree, pw, &us->users) != ALLOW)
@@ -571,7 +571,7 @@ display_defaults(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
     struct defaults *d;
     char *prefix;
     int nfound = 0;
-    debug_decl(display_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_defaults, SUDOERS_DEBUG_PARSER);
 
     if (lbuf->len == 0 || isspace((unsigned char)lbuf->buf[lbuf->len - 1]))
 	prefix = "    ";
@@ -614,7 +614,7 @@ display_bound_defaults_by_type(struct sudoers_parse_tree *parse_tree,
     struct member *m;
     char *dsep;
     int atype, nfound = 0;
-    debug_decl(display_bound_defaults_by_type, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_bound_defaults_by_type, SUDOERS_DEBUG_PARSER);
 
     switch (deftype) {
 	case DEFAULTS_HOST:
@@ -670,7 +670,7 @@ display_bound_defaults(struct sudoers_parse_tree *parse_tree,
     struct passwd *pw, struct sudo_lbuf *lbuf)
 {
     int nfound = 0;
-    debug_decl(display_bound_defaults, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_bound_defaults, SUDOERS_DEBUG_PARSER);
 
     /* XXX - should only print ones that match what the user can do. */
     nfound += display_bound_defaults_by_type(parse_tree, DEFAULTS_RUNAS, lbuf);
@@ -686,7 +686,7 @@ output(const char *buf)
 {
     struct sudo_conv_message msg;
     struct sudo_conv_reply repl;
-    debug_decl(output, SUDOERS_DEBUG_NSS)
+    debug_decl(output, SUDOERS_DEBUG_NSS);
 
     /* Call conversation function */
     memset(&msg, 0, sizeof(msg));
@@ -709,7 +709,7 @@ display_privs(struct sudo_nss_list *snl, struct passwd *pw, bool verbose)
     struct sudo_lbuf def_buf, priv_buf;
     struct stat sb;
     int cols, count, olen, n;
-    debug_decl(display_privs, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_privs, SUDOERS_DEBUG_PARSER);
 
     cols = sudo_user.cols;
     if (fstat(STDOUT_FILENO, &sb) == 0 && S_ISFIFO(sb.st_mode))
@@ -796,7 +796,7 @@ display_cmnd_check(struct sudoers_parse_tree *parse_tree, struct passwd *pw,
     struct cmndspec *cs;
     struct privilege *priv;
     struct userspec *us;
-    debug_decl(display_cmnd_check, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_cmnd_check, SUDOERS_DEBUG_PARSER);
 
     TAILQ_FOREACH_REVERSE(us, &parse_tree->userspecs, userspec_list, entries) {
 	if (userlist_matches(parse_tree, pw, &us->users) != ALLOW)
@@ -839,7 +839,7 @@ display_cmnd(struct sudo_nss_list *snl, struct passwd *pw)
     int m, match = UNSPEC;
     int ret = false;
     time_t now;
-    debug_decl(display_cmnd, SUDOERS_DEBUG_PARSER)
+    debug_decl(display_cmnd, SUDOERS_DEBUG_PARSER);
 
     /* Iterate over each source, checking for the command. */
     time(&now);
diff --git a/plugins/sudoers/parse_ldif.c b/plugins/sudoers/parse_ldif.c
index 99dbbc5b6..866cbf8ce 100644
--- a/plugins/sudoers/parse_ldif.c
+++ b/plugins/sudoers/parse_ldif.c
@@ -58,7 +58,7 @@ STAILQ_HEAD(sudo_role_list, sudo_role);
 static void
 sudo_role_free(struct sudo_role *role)
 {
-    debug_decl(sudo_role_free, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudo_role_free, SUDOERS_DEBUG_UTIL);
 
     if (role != NULL) {
 	free(role->cn);
@@ -80,7 +80,7 @@ static struct sudo_role *
 sudo_role_alloc(void)
 {
     struct sudo_role *role;
-    debug_decl(sudo_role_alloc, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudo_role_alloc, SUDOERS_DEBUG_UTIL);
 
     role = calloc(1, sizeof(*role));
     if (role != NULL) {
@@ -112,7 +112,7 @@ ldif_parse_attribute(char *line, char **name, char **value)
     bool encoded = false;
     char *attr, *cp, *ep, *colon;
     size_t len;
-    debug_decl(ldif_parse_attribute, SUDOERS_DEBUG_UTIL)
+    debug_decl(ldif_parse_attribute, SUDOERS_DEBUG_UTIL);
 
     /* Parse attribute name: [a-zA-Z][a-zA-Z0-9-]*: */
     if (!isalpha((unsigned char)*line))
@@ -180,7 +180,7 @@ static void
 ldif_store_string(const char *str, struct sudoers_str_list *strlist, bool sorted)
 {
     struct sudoers_string *ls;
-    debug_decl(ldif_store_string, SUDOERS_DEBUG_UTIL)
+    debug_decl(ldif_store_string, SUDOERS_DEBUG_UTIL);
 
     if ((ls = sudoers_string_alloc(str)) == NULL) {
 	sudo_fatalx(U_("%s: %s"), __func__,
@@ -231,7 +231,7 @@ role_order_cmp(const void *va, const void *vb)
 {
     const struct sudo_role *a = *(const struct sudo_role **)va;
     const struct sudo_role *b = *(const struct sudo_role **)vb;
-    debug_decl(role_order_cmp, SUDOERS_DEBUG_LDAP)
+    debug_decl(role_order_cmp, SUDOERS_DEBUG_LDAP);
 
     debug_return_int(a->order < b->order ? -1 :
         (a->order > b->order ? 1 : 0));
@@ -247,7 +247,7 @@ ldif_store_options(struct sudoers_parse_tree *parse_tree,
     struct defaults *d;
     struct sudoers_string *ls;
     char *var, *val;
-    debug_decl(ldif_store_options, SUDOERS_DEBUG_UTIL)
+    debug_decl(ldif_store_options, SUDOERS_DEBUG_UTIL);
 
     STAILQ_FOREACH(ls, options, entries) {
 	if ((d = calloc(1, sizeof(*d))) == NULL ||
@@ -297,7 +297,7 @@ str_list_cache(struct rbtree *cache, struct sudoers_str_list **strlistp)
     struct sudoers_str_list *strlist = *strlistp;
     struct rbnode *node;
     int ret;
-    debug_decl(str_list_cache, SUDOERS_DEBUG_UTIL)
+    debug_decl(str_list_cache, SUDOERS_DEBUG_UTIL);
 
     ret = rbinsert(cache, strlist, &node);
     switch (ret) {
@@ -328,7 +328,7 @@ role_to_sudoers(struct sudoers_parse_tree *parse_tree, struct sudo_role *role,
     struct sudoers_string *ls;
     struct userspec *us;
     struct member *m;
-    debug_decl(role_to_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(role_to_sudoers, SUDOERS_DEBUG_UTIL);
 
     /*
      * TODO: use cn to create a UserAlias if multiple users in it?
@@ -465,7 +465,7 @@ ldif_to_sudoers(struct sudoers_parse_tree *parse_tree,
 {
     struct sudo_role **role_array, *role = NULL;
     unsigned int n;
-    debug_decl(ldif_to_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(ldif_to_sudoers, SUDOERS_DEBUG_UTIL);
 
     /* Convert from list of roles to array and sort by order. */
     role_array = reallocarray(NULL, numroles + 1, sizeof(*role_array));
@@ -531,7 +531,7 @@ char *unquote_cn(const char *src)
 {
     char *dst, *new_cn;
     size_t len;
-    debug_decl(unquote_cn, SUDOERS_DEBUG_UTIL)
+    debug_decl(unquote_cn, SUDOERS_DEBUG_UTIL);
 
     len = strlen(src);
     if ((new_cn = malloc(len + 1)) == NULL)
@@ -566,7 +566,7 @@ sudoers_parse_ldif(struct sudoers_parse_tree *parse_tree,
     ssize_t savedlen = 0;
     bool mismatch = false;
     int errors = 0;
-    debug_decl(sudoers_parse_ldif, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_parse_ldif, SUDOERS_DEBUG_UTIL);
 
     /* Free old contents of the parse tree (if any). */
     free_parse_tree(parse_tree);
diff --git a/plugins/sudoers/policy.c b/plugins/sudoers/policy.c
index 1c4e70734..fe7e9cfc1 100644
--- a/plugins/sudoers/policy.c
+++ b/plugins/sudoers/policy.c
@@ -77,7 +77,7 @@ extern char *login_style;
 static int
 parse_bool(const char *line, int varlen, int *flags, int fval)
 {
-    debug_decl(parse_bool, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(parse_bool, SUDOERS_DEBUG_PLUGIN);
 
     switch (sudo_strtobool(line + varlen + 1)) {
     case true:
@@ -105,7 +105,7 @@ sudoers_policy_deserialize_info(void *v, char **runas_user, char **runas_group)
     const char *p, *errstr, *groups = NULL;
     const char *remhost = NULL;
     int flags = 0;
-    debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_deserialize_info, SUDOERS_DEBUG_PLUGIN);
 
 #define MATCHES(s, v)	\
     (strncmp((s), (v), sizeof(v) - 1) == 0)
@@ -516,7 +516,7 @@ serialize_list(const char *varname, struct list_members *members)
     struct list_member *lm, *next;
     size_t len, result_size;
     char *result;
-    debug_decl(serialize_list, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(serialize_list, SUDOERS_DEBUG_PLUGIN);
 
     result_size = strlen(varname) + 1;
     SLIST_FOREACH(lm, members, entries) {
@@ -558,7 +558,7 @@ sudoers_policy_exec_setup(char *argv[], char *envp[], mode_t cmnd_umask,
     struct sudoers_exec_args *exec_args = v;
     char **command_info;
     int info_len = 0;
-    debug_decl(sudoers_policy_exec_setup, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_exec_setup, SUDOERS_DEBUG_PLUGIN);
 
     /* Increase the length of command_info as needed, it is *not* checked. */
     command_info = calloc(48, sizeof(char *));
@@ -830,7 +830,7 @@ sudoers_policy_open(unsigned int version, sudo_conv_t conversation,
     struct sudoers_policy_open_info info;
     const char *cp, *plugin_path = NULL;
     char * const *cur;
-    debug_decl(sudoers_policy_open, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_open, SUDOERS_DEBUG_PLUGIN);
 
     sudo_version = version;
     sudo_conv = conversation;
@@ -866,7 +866,7 @@ sudoers_policy_open(unsigned int version, sudo_conv_t conversation,
 static void
 sudoers_policy_close(int exit_status, int error_code)
 {
-    debug_decl(sudoers_policy_close, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_close, SUDOERS_DEBUG_PLUGIN);
 
     /* We do not currently log the exit status. */
     if (error_code) {
@@ -915,7 +915,7 @@ sudoers_policy_close(int exit_status, int error_code)
 static int
 sudoers_policy_init_session(struct passwd *pwd, char **user_env[])
 {
-    debug_decl(sudoers_policy_init_session, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_init_session, SUDOERS_DEBUG_PLUGIN);
 
     /* user_env is only specified for API version 1.2 and higher. */
     if (sudo_version < SUDO_API_MKVERSION(1, 2))
@@ -930,7 +930,7 @@ sudoers_policy_check(int argc, char * const argv[], char *env_add[],
 {
     struct sudoers_exec_args exec_args;
     int ret;
-    debug_decl(sudoers_policy_check, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_check, SUDOERS_DEBUG_PLUGIN);
 
     if (!ISSET(sudo_mode, MODE_EDIT))
 	SET(sudo_mode, MODE_RUN);
@@ -952,7 +952,7 @@ sudoers_policy_check(int argc, char * const argv[], char *env_add[],
 static int
 sudoers_policy_validate(void)
 {
-    debug_decl(sudoers_policy_validate, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_validate, SUDOERS_DEBUG_PLUGIN);
 
     user_cmnd = "validate";
     SET(sudo_mode, MODE_VALIDATE);
@@ -963,7 +963,7 @@ sudoers_policy_validate(void)
 static void
 sudoers_policy_invalidate(int remove)
 {
-    debug_decl(sudoers_policy_invalidate, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_invalidate, SUDOERS_DEBUG_PLUGIN);
 
     user_cmnd = "kill";
     /* XXX - plugin API should support a return value for fatal errors. */
@@ -978,7 +978,7 @@ sudoers_policy_list(int argc, char * const argv[], int verbose,
     const char *list_user)
 {
     int ret;
-    debug_decl(sudoers_policy_list, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_list, SUDOERS_DEBUG_PLUGIN);
 
     user_cmnd = "list";
     if (argc)
@@ -1004,7 +1004,7 @@ sudoers_policy_list(int argc, char * const argv[], int verbose,
 static int
 sudoers_policy_version(int verbose)
 {
-    debug_decl(sudoers_policy_version, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_version, SUDOERS_DEBUG_PLUGIN);
 
     sudo_printf(SUDO_CONV_INFO_MSG, _("Sudoers policy plugin version %s\n"),
 	PACKAGE_VERSION);
diff --git a/plugins/sudoers/prompt.c b/plugins/sudoers/prompt.c
index 3d8a97ddf..42389fd4e 100644
--- a/plugins/sudoers/prompt.c
+++ b/plugins/sudoers/prompt.c
@@ -53,7 +53,7 @@ expand_prompt(const char *old_prompt, const char *auth_user)
     int subst;
     const char *p;
     char *np, *new_prompt, *endp;
-    debug_decl(expand_prompt, SUDOERS_DEBUG_AUTH)
+    debug_decl(expand_prompt, SUDOERS_DEBUG_AUTH);
 
     /* How much space do we need to malloc for the prompt? */
     subst = 0;
diff --git a/plugins/sudoers/pwutil.c b/plugins/sudoers/pwutil.c
index 5176686a6..a92781277 100644
--- a/plugins/sudoers/pwutil.c
+++ b/plugins/sudoers/pwutil.c
@@ -92,7 +92,7 @@ void
 sudo_pwutil_set_backend(sudo_make_pwitem_t pwitem, sudo_make_gritem_t gritem,
     sudo_make_gidlist_item_t gidlist_item, sudo_make_grlist_item_t grlist_item)
 {
-    debug_decl(sudo_pwutil_set_backend, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_pwutil_set_backend, SUDOERS_DEBUG_NSS);
 
     make_pwitem = pwitem;
     make_gritem = gritem;
@@ -158,7 +158,7 @@ cmp_gidlist(const void *v1, const void *v2)
 void
 sudo_pw_addref(struct passwd *pw)
 {
-    debug_decl(sudo_pw_addref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_pw_addref, SUDOERS_DEBUG_NSS);
     ptr_to_item(pw)->refcnt++;
     debug_return;
 }
@@ -167,7 +167,7 @@ static void
 sudo_pw_delref_item(void *v)
 {
     struct cache_item *item = v;
-    debug_decl(sudo_pw_delref_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_pw_delref_item, SUDOERS_DEBUG_NSS);
 
     if (--item->refcnt == 0)
 	free(item);
@@ -178,7 +178,7 @@ sudo_pw_delref_item(void *v)
 void
 sudo_pw_delref(struct passwd *pw)
 {
-    debug_decl(sudo_pw_delref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_pw_delref, SUDOERS_DEBUG_NSS);
     sudo_pw_delref_item(ptr_to_item(pw));
     debug_return;
 }
@@ -191,7 +191,7 @@ sudo_getpwuid(uid_t uid)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_getpwuid, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_getpwuid, SUDOERS_DEBUG_NSS);
 
     if (pwcache_byuid == NULL) {
 	pwcache_byuid = rbcreate(cmp_pwuid);
@@ -262,7 +262,7 @@ sudo_getpwnam(const char *name)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_getpwnam, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_getpwnam, SUDOERS_DEBUG_NSS);
 
     if (pwcache_byname == NULL) {
 	pwcache_byname = rbcreate(cmp_pwnam);
@@ -338,7 +338,7 @@ sudo_mkpwent(const char *user, uid_t uid, gid_t gid, const char *home,
     struct passwd *pw;
     size_t len, name_len, home_len, shell_len;
     int i;
-    debug_decl(sudo_mkpwent, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_mkpwent, SUDOERS_DEBUG_NSS);
 
     if (pwcache_byuid == NULL)
 	pwcache_byuid = rbcreate(cmp_pwuid);
@@ -434,7 +434,7 @@ sudo_fakepwnam(const char *user, gid_t gid)
 {
     const char *errstr;
     uid_t uid;
-    debug_decl(sudo_fakepwnam, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_fakepwnam, SUDOERS_DEBUG_NSS);
 
     uid = (uid_t) sudo_strtoid(user + 1, &errstr);
     if (errstr != NULL) {
@@ -448,7 +448,7 @@ sudo_fakepwnam(const char *user, gid_t gid)
 void
 sudo_freepwcache(void)
 {
-    debug_decl(sudo_freepwcache, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_freepwcache, SUDOERS_DEBUG_NSS);
 
     if (pwcache_byuid != NULL) {
 	rbdestroy(pwcache_byuid, sudo_pw_delref_item);
@@ -481,7 +481,7 @@ cmp_grgid(const void *v1, const void *v2)
 void
 sudo_gr_addref(struct group *gr)
 {
-    debug_decl(sudo_gr_addref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gr_addref, SUDOERS_DEBUG_NSS);
     ptr_to_item(gr)->refcnt++;
     debug_return;
 }
@@ -490,7 +490,7 @@ static void
 sudo_gr_delref_item(void *v)
 {
     struct cache_item *item = v;
-    debug_decl(sudo_gr_delref_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gr_delref_item, SUDOERS_DEBUG_NSS);
 
     if (--item->refcnt == 0)
 	free(item);
@@ -501,7 +501,7 @@ sudo_gr_delref_item(void *v)
 void
 sudo_gr_delref(struct group *gr)
 {
-    debug_decl(sudo_gr_delref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gr_delref, SUDOERS_DEBUG_NSS);
     sudo_gr_delref_item(ptr_to_item(gr));
     debug_return;
 }
@@ -514,7 +514,7 @@ sudo_getgrgid(gid_t gid)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_getgrgid, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_getgrgid, SUDOERS_DEBUG_NSS);
 
     if (grcache_bygid == NULL) {
 	grcache_bygid = rbcreate(cmp_grgid);
@@ -578,7 +578,7 @@ sudo_getgrnam(const char *name)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_getgrnam, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_getgrnam, SUDOERS_DEBUG_NSS);
 
     if (grcache_byname == NULL) {
 	grcache_byname = rbcreate(cmp_grnam);
@@ -647,7 +647,7 @@ sudo_fakegrnam(const char *group)
     struct group *gr;
     size_t len, name_len;
     int i;
-    debug_decl(sudo_fakegrnam, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_fakegrnam, SUDOERS_DEBUG_NSS);
 
     if (grcache_bygid == NULL)
 	grcache_bygid = rbcreate(cmp_grgid);
@@ -722,7 +722,7 @@ sudo_fakegrnam(const char *group)
 void
 sudo_gidlist_addref(struct gid_list *gidlist)
 {
-    debug_decl(sudo_gidlist_addref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gidlist_addref, SUDOERS_DEBUG_NSS);
     ptr_to_item(gidlist)->refcnt++;
     debug_return;
 }
@@ -731,7 +731,7 @@ static void
 sudo_gidlist_delref_item(void *v)
 {
     struct cache_item *item = v;
-    debug_decl(sudo_gidlist_delref_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gidlist_delref_item, SUDOERS_DEBUG_NSS);
 
     if (--item->refcnt == 0)
 	free(item);
@@ -742,7 +742,7 @@ sudo_gidlist_delref_item(void *v)
 void
 sudo_gidlist_delref(struct gid_list *gidlist)
 {
-    debug_decl(sudo_gidlist_delref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_gidlist_delref, SUDOERS_DEBUG_NSS);
     sudo_gidlist_delref_item(ptr_to_item(gidlist));
     debug_return;
 }
@@ -750,7 +750,7 @@ sudo_gidlist_delref(struct gid_list *gidlist)
 void
 sudo_grlist_addref(struct group_list *grlist)
 {
-    debug_decl(sudo_grlist_addref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_grlist_addref, SUDOERS_DEBUG_NSS);
     ptr_to_item(grlist)->refcnt++;
     debug_return;
 }
@@ -759,7 +759,7 @@ static void
 sudo_grlist_delref_item(void *v)
 {
     struct cache_item *item = v;
-    debug_decl(sudo_grlist_delref_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_grlist_delref_item, SUDOERS_DEBUG_NSS);
 
     if (--item->refcnt == 0)
 	free(item);
@@ -770,7 +770,7 @@ sudo_grlist_delref_item(void *v)
 void
 sudo_grlist_delref(struct group_list *grlist)
 {
-    debug_decl(sudo_grlist_delref, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_grlist_delref, SUDOERS_DEBUG_NSS);
     sudo_grlist_delref_item(ptr_to_item(grlist));
     debug_return;
 }
@@ -778,7 +778,7 @@ sudo_grlist_delref(struct group_list *grlist)
 void
 sudo_freegrcache(void)
 {
-    debug_decl(sudo_freegrcache, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_freegrcache, SUDOERS_DEBUG_NSS);
 
     if (grcache_bygid != NULL) {
 	rbdestroy(grcache_bygid, sudo_gr_delref_item);
@@ -805,7 +805,7 @@ sudo_get_grlist(const struct passwd *pw)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_get_grlist, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_get_grlist, SUDOERS_DEBUG_NSS);
 
     sudo_debug_printf(SUDO_DEBUG_DEBUG, "%s: looking up group names for %s",
 	__func__, pw->pw_name);
@@ -865,7 +865,7 @@ sudo_set_grlist(struct passwd *pw, char * const *groups)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_set_grlist, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_set_grlist, SUDOERS_DEBUG_NSS);
 
     if (grlist_cache == NULL) {
 	grlist_cache = rbcreate(cmp_pwnam);
@@ -906,7 +906,7 @@ sudo_get_gidlist(const struct passwd *pw, unsigned int type)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_get_gidlist, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_get_gidlist, SUDOERS_DEBUG_NSS);
 
     sudo_debug_printf(SUDO_DEBUG_DEBUG, "%s: looking up group-IDs for %s",
 	__func__, pw->pw_name);
@@ -967,7 +967,7 @@ sudo_set_gidlist(struct passwd *pw, char * const *gids, unsigned int type)
 {
     struct cache_item key, *item;
     struct rbnode *node;
-    debug_decl(sudo_set_gidlist, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_set_gidlist, SUDOERS_DEBUG_NSS);
 
     if (gidlist_cache == NULL) {
 	gidlist_cache = rbcreate(cmp_gidlist);
@@ -1012,7 +1012,7 @@ user_in_group(const struct passwd *pw, const char *group)
     struct group *grp = NULL;
     bool matched = false;
     int i;
-    debug_decl(user_in_group, SUDOERS_DEBUG_NSS)
+    debug_decl(user_in_group, SUDOERS_DEBUG_NSS);
 
     /*
      * If it could be a sudo-style group-ID check gids first.
diff --git a/plugins/sudoers/pwutil_impl.c b/plugins/sudoers/pwutil_impl.c
index 9d56e732b..2634ee445 100644
--- a/plugins/sudoers/pwutil_impl.c
+++ b/plugins/sudoers/pwutil_impl.c
@@ -87,7 +87,7 @@ sudo_make_pwitem(uid_t uid, const char *name)
     size_t nsize, psize, csize, gsize, dsize, ssize, total;
     struct cache_item_pw *pwitem;
     struct passwd *pw, *newpw;
-    debug_decl(sudo_make_pwitem, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_make_pwitem, SUDOERS_DEBUG_NSS);
 
     /* Look up by name or uid. */
     pw = name ? getpwnam(name) : getpwuid(uid);
@@ -169,7 +169,7 @@ sudo_make_gritem(gid_t gid, const char *name)
     size_t nsize, psize, nmem, total, len;
     struct cache_item_gr *gritem;
     struct group *gr, *newgr;
-    debug_decl(sudo_make_gritem, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_make_gritem, SUDOERS_DEBUG_NSS);
 
     /* Look up by name or gid. */
     gr = name ? getgrnam(name) : getgrgid(gid);
@@ -247,7 +247,7 @@ sudo_make_gidlist_item(const struct passwd *pw, char * const *unused1,
     struct gid_list *gidlist;
     GETGROUPS_T *gids;
     int i, ngids;
-    debug_decl(sudo_make_gidlist_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_make_gidlist_item, SUDOERS_DEBUG_NSS);
 
     /* Don't use user_gids if the entry type says we must query the db. */
     if (type != ENTRY_TYPE_QUERIED && pw == sudo_user.pw && sudo_user.gids != NULL) {
@@ -336,7 +336,7 @@ sudo_make_grlist_item(const struct passwd *pw, char * const *unused1)
     struct gid_list *gidlist;
     struct group *grp = NULL;
     int i, groupname_len;
-    debug_decl(sudo_make_grlist_item, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_make_grlist_item, SUDOERS_DEBUG_NSS);
 
     gidlist = sudo_get_gidlist(pw, ENTRY_TYPE_ANY);
     if (gidlist == NULL) {
diff --git a/plugins/sudoers/rcstr.c b/plugins/sudoers/rcstr.c
index 96b12b551..f506ba592 100644
--- a/plugins/sudoers/rcstr.c
+++ b/plugins/sudoers/rcstr.c
@@ -57,7 +57,7 @@ rcstr_dup(const char *src)
 {
     size_t len = strlen(src);
     char *dst;
-    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL)
+    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL);
 
     dst = rcstr_alloc(len);
     memcpy(dst, src, len);
@@ -69,7 +69,7 @@ char *
 rcstr_alloc(size_t len)
 {
     struct rcstr *rcs;
-    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL)
+    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL);
 
     /* Note: sizeof(struct rcstr) includes space for the NUL */
     rcs = malloc(sizeof(struct rcstr) + len);
@@ -86,7 +86,7 @@ char *
 rcstr_addref(const char *s)
 {
     struct rcstr *rcs;
-    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL)
+    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL);
 
     if (s == NULL)
 	debug_return_ptr(NULL);
@@ -100,7 +100,7 @@ void
 rcstr_delref(const char *s)
 {
     struct rcstr *rcs;
-    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL)
+    debug_decl(rcstr_dup, SUDOERS_DEBUG_UTIL);
 
     if (s != NULL) {
 	rcs = __containerof((const void *)s, struct rcstr, str);
diff --git a/plugins/sudoers/redblack.c b/plugins/sudoers/redblack.c
index f43d98aa4..4673c2d3b 100644
--- a/plugins/sudoers/redblack.c
+++ b/plugins/sudoers/redblack.c
@@ -89,7 +89,7 @@ struct rbtree *
 rbcreate(int (*compar)(const void *, const void*))
 {
     struct rbtree *tree;
-    debug_decl(rbcreate, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbcreate, SUDOERS_DEBUG_RBTREE);
 
     if ((tree = malloc(sizeof(*tree))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -125,7 +125,7 @@ static void
 rotate_left(struct rbtree *tree, struct rbnode *node)
 {
     struct rbnode *child;
-    debug_decl(rotate_left, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rotate_left, SUDOERS_DEBUG_RBTREE);
 
     child = node->right;
     node->right = child->left;
@@ -151,7 +151,7 @@ static void
 rotate_right(struct rbtree *tree, struct rbnode *node)
 {
     struct rbnode *child;
-    debug_decl(rotate_right, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rotate_right, SUDOERS_DEBUG_RBTREE);
 
     child = node->left;
     node->left = child->right;
@@ -181,7 +181,7 @@ rbinsert(struct rbtree *tree, void *data, struct rbnode **existing)
     struct rbnode *node = rbfirst(tree);
     struct rbnode *parent = rbroot(tree);
     int res;
-    debug_decl(rbinsert, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbinsert, SUDOERS_DEBUG_RBTREE);
 
     /* Find correct insertion point. */
     while (node != rbnil(tree)) {
@@ -281,7 +281,7 @@ rbfind(struct rbtree *tree, void *key)
 {
     struct rbnode *node = rbfirst(tree);
     int res;
-    debug_decl(rbfind, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbfind, SUDOERS_DEBUG_RBTREE);
 
     while (node != rbnil(tree)) {
 	if ((res = tree->compar(key, node->data)) == 0)
@@ -301,7 +301,7 @@ rbapply_node(struct rbtree *tree, struct rbnode *node,
     int (*func)(void *, void *), void *cookie, enum rbtraversal order)
 {
     int error;
-    debug_decl(rbapply_node, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbapply_node, SUDOERS_DEBUG_RBTREE);
 
     if (node != rbnil(tree)) {
 	if (order == preorder)
@@ -328,7 +328,7 @@ static struct rbnode *
 rbsuccessor(struct rbtree *tree, struct rbnode *node)
 {
     struct rbnode *succ;
-    debug_decl(rbsuccessor, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbsuccessor, SUDOERS_DEBUG_RBTREE);
 
     if ((succ = node->right) != rbnil(tree)) {
 	while (succ->left != rbnil(tree))
@@ -349,7 +349,7 @@ rbsuccessor(struct rbtree *tree, struct rbnode *node)
 static void
 rbdestroy_int(struct rbtree *tree, struct rbnode *node, void (*destroy)(void *))
 {
-    debug_decl(rbdestroy_int, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbdestroy_int, SUDOERS_DEBUG_RBTREE);
     if (node != rbnil(tree)) {
 	rbdestroy_int(tree, node->left, destroy);
 	rbdestroy_int(tree, node->right, destroy);
@@ -367,7 +367,7 @@ rbdestroy_int(struct rbtree *tree, struct rbnode *node, void (*destroy)(void *))
 void
 rbdestroy(struct rbtree *tree, void (*destroy)(void *))
 {
-    debug_decl(rbdestroy, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbdestroy, SUDOERS_DEBUG_RBTREE);
     rbdestroy_int(tree, rbfirst(tree), destroy);
     free(tree);
     debug_return;
@@ -380,7 +380,7 @@ void *rbdelete(struct rbtree *tree, struct rbnode *z)
 {
     struct rbnode *x, *y;
     void *data = z->data;
-    debug_decl(rbdelete, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbdelete, SUDOERS_DEBUG_RBTREE);
 
     if (z->left == rbnil(tree) || z->right == rbnil(tree))
 	y = z;
@@ -422,7 +422,7 @@ static void
 rbrepair(struct rbtree *tree, struct rbnode *node)
 {
     struct rbnode *sibling;
-    debug_decl(rbrepair, SUDOERS_DEBUG_RBTREE)
+    debug_decl(rbrepair, SUDOERS_DEBUG_RBTREE);
 
     while (node->color == black && node != rbfirst(tree)) {
 	if (node == node->parent->left) {
diff --git a/plugins/sudoers/set_perms.c b/plugins/sudoers/set_perms.c
index d77e5b4e3..e80b42008 100644
--- a/plugins/sudoers/set_perms.c
+++ b/plugins/sudoers/set_perms.c
@@ -84,7 +84,7 @@ static int perm_stack_depth = 0;
 bool
 rewind_perms(void)
 {
-    debug_decl(rewind_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(rewind_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth != 0) {
 	while (perm_stack_depth > 1) {
@@ -114,7 +114,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     char errbuf[1024];
     const char *errstr = errbuf;
-    debug_decl(set_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(set_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth == PERM_STACK_MAX) {
 	errstr = N_("perm stack overflow");
@@ -372,7 +372,7 @@ bool
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
-    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth < 2) {
 	sudo_warnx(U_("perm stack underflow"));
@@ -441,7 +441,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     char errbuf[1024];
     const char *errstr = errbuf;
-    debug_decl(set_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(set_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth == PERM_STACK_MAX) {
 	errstr = N_("perm stack overflow");
@@ -711,7 +711,7 @@ bool
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
-    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth < 2) {
 	sudo_warnx(U_("perm stack underflow"));
@@ -844,7 +844,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     char errbuf[1024];
     const char *errstr = errbuf;
-    debug_decl(set_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(set_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth == PERM_STACK_MAX) {
 	errstr = N_("perm stack overflow");
@@ -1074,7 +1074,7 @@ bool
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
-    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth < 2) {
 	sudo_warnx(U_("perm stack underflow"));
@@ -1150,7 +1150,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     char errbuf[1024];
     const char *errstr = errbuf;
-    debug_decl(set_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(set_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth == PERM_STACK_MAX) {
 	errstr = N_("perm stack overflow");
@@ -1377,7 +1377,7 @@ bool
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
-    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth < 2) {
 	sudo_warnx(U_("perm stack underflow"));
@@ -1444,7 +1444,7 @@ set_perms(int perm)
     struct perm_state *state, *ostate = NULL;
     char errbuf[1024];
     const char *errstr = errbuf;
-    debug_decl(set_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(set_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth == PERM_STACK_MAX) {
 	errstr = N_("perm stack overflow");
@@ -1542,7 +1542,7 @@ boll
 restore_perms(void)
 {
     struct perm_state *state, *ostate;
-    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS)
+    debug_decl(restore_perms, SUDOERS_DEBUG_PERMS);
 
     if (perm_stack_depth < 2) {
 	sudo_warnx(U_("perm stack underflow"));
@@ -1585,7 +1585,7 @@ static struct gid_list *
 runas_setgroups(void)
 {
     struct gid_list *gidlist;
-    debug_decl(runas_setgroups, SUDOERS_DEBUG_PERMS)
+    debug_decl(runas_setgroups, SUDOERS_DEBUG_PERMS);
 
     gidlist = runas_getgroups();
     if (gidlist != NULL && !def_preserve_groups) {
diff --git a/plugins/sudoers/sssd.c b/plugins/sudoers/sssd.c
index f859d03fc..f517d19b7 100644
--- a/plugins/sudoers/sssd.c
+++ b/plugins/sudoers/sssd.c
@@ -108,7 +108,7 @@ get_ipa_hostname(char **shostp, char **lhostp)
     int ret = false;
     ssize_t len;
     FILE *fp;
-    debug_decl(get_ipa_hostname, SUDOERS_DEBUG_SSSD)
+    debug_decl(get_ipa_hostname, SUDOERS_DEBUG_SSSD);
 
     fp = fopen(_PATH_SSSD_CONF, "r");
     if (fp != NULL) {
@@ -247,7 +247,7 @@ sss_to_sudoers(struct sudo_sss_handle *handle,
     struct userspec *us;
     struct member *m;
     unsigned int i;
-    debug_decl(sss_to_sudoers, SUDOERS_DEBUG_SSSD)
+    debug_decl(sss_to_sudoers, SUDOERS_DEBUG_SSSD);
 
     /* We only have a single userspec */
     if ((us = calloc(1, sizeof(*us))) == NULL)
diff --git a/plugins/sudoers/starttime.c b/plugins/sudoers/starttime.c
index c4f1d1944..f5382d11d 100644
--- a/plugins/sudoers/starttime.c
+++ b/plugins/sudoers/starttime.c
@@ -92,7 +92,7 @@ get_starttime(pid_t pid, struct timespec *starttime)
     struct sudo_kinfo_proc *ki_proc = NULL;
     size_t size = sizeof(*ki_proc);
     int mib[6], rc;
-    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL);
 
     /*
      * Lookup start time for pid via sysctl.
@@ -145,7 +145,7 @@ get_starttime(pid_t pid, struct timespec *starttime)
     char path[PATH_MAX];
     ssize_t nread;
     int fd, ret = -1;
-    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL);
 
     /* Determine the start time from pr_start in /proc/pid/psinfo. */
     (void)snprintf(path, sizeof(path), "/proc/%u/psinfo", (unsigned int)pid);
@@ -178,7 +178,7 @@ get_starttime(pid_t pid, struct timespec *starttime)
     int ret = -1;
     int fd = -1;
     long tps;
-    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL);
 
     /*
      * Start time is in ticks per second on Linux.
@@ -275,7 +275,7 @@ get_starttime(pid_t pid, struct timespec *starttime)
 {
     struct pst_status pstat;
     int rc;
-    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL);
 
     /*
      * Determine the start time from pst_start in struct pst_status.
@@ -302,7 +302,7 @@ get_starttime(pid_t pid, struct timespec *starttime)
 int
 get_starttime(pid_t pid, struct timespec *starttime)
 {
-    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_starttime, SUDOERS_DEBUG_UTIL);
 
     sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
 	"process start time not supported by sudo on this system");
diff --git a/plugins/sudoers/strlist.c b/plugins/sudoers/strlist.c
index 69ad7beed..321898873 100644
--- a/plugins/sudoers/strlist.c
+++ b/plugins/sudoers/strlist.c
@@ -43,7 +43,7 @@ struct sudoers_string *
 sudoers_string_alloc(const char *s)
 {
     struct sudoers_string *cs;
-    debug_decl(sudoers_string_alloc, SUDOERS_DEBUG_UTIL)
+    debug_decl(sudoers_string_alloc, SUDOERS_DEBUG_UTIL);
 
     if ((cs = malloc(sizeof(*cs))) != NULL) {
 	if ((cs->str = strdup(s)) == NULL) {
@@ -68,7 +68,7 @@ struct sudoers_str_list *
 str_list_alloc(void)
 {
     struct sudoers_str_list *strlist;
-    debug_decl(str_list_alloc, SUDOERS_DEBUG_UTIL)
+    debug_decl(str_list_alloc, SUDOERS_DEBUG_UTIL);
 
     strlist = malloc(sizeof(*strlist));
     if (strlist != NULL) {
@@ -84,7 +84,7 @@ str_list_free(void *v)
 {
     struct sudoers_str_list *strlist = v;
     struct sudoers_string *first;
-    debug_decl(str_list_free, SUDOERS_DEBUG_UTIL)
+    debug_decl(str_list_free, SUDOERS_DEBUG_UTIL);
 
     if (strlist != NULL) {
 	if (--strlist->refcnt == 0) {
diff --git a/plugins/sudoers/stubs.c b/plugins/sudoers/stubs.c
index caf15c31f..327f8e25e 100644
--- a/plugins/sudoers/stubs.c
+++ b/plugins/sudoers/stubs.c
@@ -94,7 +94,7 @@ void
 get_hostname(void)
 {
     char *cp;
-    debug_decl(get_hostname, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_hostname, SUDOERS_DEBUG_UTIL);
 
     if ((user_host = sudo_gethostname()) != NULL) {
 	if ((cp = strchr(user_host, '.'))) {
diff --git a/plugins/sudoers/sudo_nss.c b/plugins/sudoers/sudo_nss.c
index a6f592071..b186529d9 100644
--- a/plugins/sudoers/sudo_nss.c
+++ b/plugins/sudoers/sudo_nss.c
@@ -77,7 +77,7 @@ sudo_read_nss(void)
     bool saw_files = false;
     bool got_match = false;
     static struct sudo_nss_list snl = TAILQ_HEAD_INITIALIZER(snl);
-    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS);
 
     if ((fp = fopen(_PATH_NSSWITCH_CONF, "r")) == NULL)
 	goto nomatch;
@@ -157,7 +157,7 @@ sudo_read_nss(void)
     bool saw_ldap = false;
     bool got_match = false;
     static struct sudo_nss_list snl = TAILQ_HEAD_INITIALIZER(snl);
-    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS);
 
     if ((fp = fopen(_PATH_NETSVC_CONF, "r")) == NULL)
 	goto nomatch;
@@ -238,7 +238,7 @@ struct sudo_nss_list *
 sudo_read_nss(void)
 {
     static struct sudo_nss_list snl = TAILQ_HEAD_INITIALIZER(snl);
-    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_read_nss, SUDOERS_DEBUG_NSS);
 
 #  ifdef HAVE_SSSD
     TAILQ_INSERT_TAIL(&snl, &sudo_nss_sss, entries);
@@ -258,7 +258,7 @@ sudo_read_nss(void)
 bool
 sudo_nss_can_continue(struct sudo_nss *nss, int match)
 {
-    debug_decl(sudo_nss_should_continue, SUDOERS_DEBUG_NSS)
+    debug_decl(sudo_nss_should_continue, SUDOERS_DEBUG_NSS);
 
     /* Handle [NOTFOUND=return] */
     if (nss->ret_if_notfound && match == UNSPEC)
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index 49dc34c35..11d41b0dc 100644
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -127,7 +127,7 @@ unlimit_nproc(void)
 {
 #ifdef __linux__
     struct rlimit rl;
-    debug_decl(unlimit_nproc, SUDOERS_DEBUG_UTIL)
+    debug_decl(unlimit_nproc, SUDOERS_DEBUG_UTIL);
 
     if (getrlimit(RLIMIT_NPROC, &nproclimit) != 0)
 	    sudo_warn("getrlimit(RLIMIT_NPROC)");
@@ -148,7 +148,7 @@ static void
 restore_nproc(void)
 {
 #ifdef __linux__
-    debug_decl(restore_nproc, SUDOERS_DEBUG_UTIL)
+    debug_decl(restore_nproc, SUDOERS_DEBUG_UTIL);
 
     if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0)
 	sudo_warn("setrlimit(RLIMIT_NPROC)");
@@ -163,7 +163,7 @@ sudoers_policy_init(void *info, char * const envp[])
     struct sudo_nss *nss, *nss_next;
     int oldlocale, sources = 0;
     int ret = -1;
-    debug_decl(sudoers_policy_init, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_init, SUDOERS_DEBUG_PLUGIN);
 
     bindtextdomain("sudoers", LOCALEDIR);
 
@@ -247,7 +247,7 @@ format_iolog_path(void)
     char *iolog_path = NULL;
     int oldlocale;
     bool ok;
-    debug_decl(format_iolog_path, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(format_iolog_path, SUDOERS_DEBUG_PLUGIN);
 
     /* Use sudoers locale for strftime() */
     sudoers_setlocale(SUDOERS_LOCALE_SUDOERS, &oldlocale);
@@ -284,7 +284,7 @@ sudoers_policy_main(int argc, char * const argv[], int pwflag, char *env_add[],
     struct sudo_nss *nss;
     int cmnd_status = -1, oldlocale, validated;
     int ret = -1;
-    debug_decl(sudoers_policy_main, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_policy_main, SUDOERS_DEBUG_PLUGIN);
 
     sudo_warn_set_locale_func(sudoers_warn_setlocale);
 
@@ -711,7 +711,7 @@ init_vars(char * const envp[])
 {
     char * const * ep;
     bool unknown_user = false;
-    debug_decl(init_vars, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(init_vars, SUDOERS_DEBUG_PLUGIN);
 
     if (!sudoers_initlocale(setlocale(LC_ALL, NULL), def_sudoers_locale)) {
 	sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
@@ -838,7 +838,7 @@ set_cmnd(void)
     struct sudo_nss *nss;
     char *path = user_path;
     int ret = FOUND;
-    debug_decl(set_cmnd, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(set_cmnd, SUDOERS_DEBUG_PLUGIN);
 
     /* Allocate user_stat for find_path() and match functions. */
     user_stat = calloc(1, sizeof(struct stat));
@@ -953,7 +953,7 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
     struct stat sb;
     FILE *fp = NULL;
     bool perm_root = false;
-    debug_decl(open_sudoers, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(open_sudoers, SUDOERS_DEBUG_PLUGIN);
 
     if (!set_perms(PERM_SUDOERS))
 	debug_return_ptr(NULL);
@@ -1050,7 +1050,7 @@ set_loginclass(struct passwd *pw)
     const int errflags = SLOG_RAW_MSG;
     login_cap_t *lc;
     bool ret = true;
-    debug_decl(set_loginclass, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(set_loginclass, SUDOERS_DEBUG_PLUGIN);
 
     if (!def_use_loginclass)
 	goto done;
@@ -1109,7 +1109,7 @@ resolve_host(const char *host, char **longp, char **shortp)
     struct addrinfo *res0, hint;
     char *cp, *lname, *sname;
     int ret;
-    debug_decl(resolve_host, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(resolve_host, SUDOERS_DEBUG_PLUGIN);
 
     memset(&hint, 0, sizeof(hint));
     hint.ai_family = PF_UNSPEC;
@@ -1147,7 +1147,7 @@ cb_fqdn(const union sudo_defs_val *sd_un)
 {
     bool remote;
     char *lhost, *shost;
-    debug_decl(cb_fqdn, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(cb_fqdn, SUDOERS_DEBUG_PLUGIN);
 
     /* Nothing to do if fqdn flag is disabled. */
     if (sd_un != NULL && !sd_un->flag)
@@ -1215,7 +1215,7 @@ static bool
 set_runaspw(const char *user, bool quiet)
 {
     struct passwd *pw = NULL;
-    debug_decl(set_runaspw, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(set_runaspw, SUDOERS_DEBUG_PLUGIN);
 
     unknown_runas_uid = false;
     if (*user == '#') {
@@ -1249,7 +1249,7 @@ static bool
 set_runasgr(const char *group, bool quiet)
 {
     struct group *gr = NULL;
-    debug_decl(set_runasgr, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(set_runasgr, SUDOERS_DEBUG_PLUGIN);
 
     unknown_runas_gid = false;
     if (*group == '#') {
@@ -1281,7 +1281,7 @@ set_runasgr(const char *group, bool quiet)
 static bool
 cb_runas_default(const union sudo_defs_val *sd_un)
 {
-    debug_decl(cb_runas_default, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(cb_runas_default, SUDOERS_DEBUG_PLUGIN);
 
     /* Only reset runaspw if user didn't specify one. */
     if (!runas_user && !runas_group)
@@ -1295,7 +1295,7 @@ cb_runas_default(const union sudo_defs_val *sd_un)
 static bool
 cb_tty_tickets(const union sudo_defs_val *sd_un)
 {
-    debug_decl(cb_tty_tickets, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(cb_tty_tickets, SUDOERS_DEBUG_PLUGIN);
 
     /* Convert tty_tickets -> timestamp_type */
     if (sd_un->flag)
@@ -1311,7 +1311,7 @@ cb_tty_tickets(const union sudo_defs_val *sd_un)
 static bool
 cb_umask(const union sudo_defs_val *sd_un)
 {
-    debug_decl(cb_umask, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(cb_umask, SUDOERS_DEBUG_PLUGIN);
 
     /* Force umask if explicitly set in sudoers. */
     force_umask = sd_un->mode != ACCESSPERMS;
@@ -1326,7 +1326,7 @@ void
 sudoers_cleanup(void)
 {
     struct sudo_nss *nss;
-    debug_decl(sudoers_cleanup, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_cleanup, SUDOERS_DEBUG_PLUGIN);
 
     if (snl != NULL) {
 	TAILQ_FOREACH(nss, snl, entries) {
@@ -1347,7 +1347,7 @@ create_admin_success_flag(void)
 {
     char flagfile[PATH_MAX];
     int len, ret = -1;
-    debug_decl(create_admin_success_flag, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(create_admin_success_flag, SUDOERS_DEBUG_PLUGIN);
 
     /* Check whether the user is in the sudo or admin group. */
     if (!user_in_group(sudo_user.pw, "sudo") &&
@@ -1383,7 +1383,7 @@ create_admin_success_flag(void)
 static bool
 tty_present(void)
 {
-    debug_decl(tty_present, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(tty_present, SUDOERS_DEBUG_PLUGIN);
     
     if (user_ttypath == NULL) {
 	int fd = open(_PATH_TTY, O_RDWR);
diff --git a/plugins/sudoers/sudoers_debug.c b/plugins/sudoers/sudoers_debug.c
index 093357210..7b208a037 100644
--- a/plugins/sudoers/sudoers_debug.c
+++ b/plugins/sudoers/sudoers_debug.c
@@ -156,7 +156,7 @@ sudoers_debug_register(const char *program,
 void
 sudoers_debug_deregister(void)
 {
-    debug_decl(sudoers_debug_deregister, SUDOERS_DEBUG_PLUGIN)
+    debug_decl(sudoers_debug_deregister, SUDOERS_DEBUG_PLUGIN);
 
     if (sudoers_debug_refcnt != 0) {
 	sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index 8495120ea..d6a9c5509 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -216,7 +216,7 @@ main(int argc, char *argv[])
     struct timespec max_delay_storage, *max_delay = NULL;
     double dval;
     FILE *fp;
-    debug_decl(main, SUDO_DEBUG_MAIN)
+    debug_decl(main, SUDO_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     {
@@ -441,7 +441,7 @@ getsize_cb(int fd, int what, void *v)
 {
     struct getsize_closure *gc = v;
     unsigned char ch = '\0';
-    debug_decl(getsize_cb, SUDO_DEBUG_UTIL)
+    debug_decl(getsize_cb, SUDO_DEBUG_UTIL);
 
     for (;;) {
 	if (gc->cp[0] == '\0') {
@@ -533,7 +533,7 @@ xterm_get_size(int *new_lines, int *new_cols)
     const char getsize_request[] = "\0337\033[r\033[999;999H\033[6n";
     const char getsize_response[] = "\033[%d;%dR";
     bool ret = false;
-    debug_decl(xterm_get_size, SUDO_DEBUG_UTIL)
+    debug_decl(xterm_get_size, SUDO_DEBUG_UTIL);
 
     /* request the terminal's size */
     if (write(ttyfd, getsize_request, strlen(getsize_request)) == -1) {
@@ -593,7 +593,7 @@ xterm_set_size(int lines, int cols)
     int len, new_lines, new_cols;
     bool ret = false;
     char buf[1024];
-    debug_decl(xterm_set_size, SUDO_DEBUG_UTIL)
+    debug_decl(xterm_set_size, SUDO_DEBUG_UTIL);
 
     /* XXX - save cursor and position restore after resizing */
     len = snprintf(buf, sizeof(buf), setsize_fmt, lines, cols);
@@ -622,7 +622,7 @@ static void
 setup_terminal(struct iolog_info *li, bool interactive, bool resize)
 {
     const char *term;
-    debug_decl(check_terminal, SUDO_DEBUG_UTIL)
+    debug_decl(check_terminal, SUDO_DEBUG_UTIL);
 
     fflush(stdout);
 
@@ -691,7 +691,7 @@ setup_terminal(struct iolog_info *li, bool interactive, bool resize)
 static void
 resize_terminal(int lines, int cols)
 {
-    debug_decl(resize_terminal, SUDO_DEBUG_UTIL)
+    debug_decl(resize_terminal, SUDO_DEBUG_UTIL);
 
     if (terminal_can_resize) {
 	if (xterm_set_size(lines, cols))
@@ -706,7 +706,7 @@ resize_terminal(int lines, int cols)
 static void
 restore_terminal_size(void)
 {
-    debug_decl(restore_terminal, SUDO_DEBUG_UTIL)
+    debug_decl(restore_terminal, SUDO_DEBUG_UTIL);
 
     if (terminal_was_resized) {
 	/* We are still in raw mode, hence the carriage return. */
@@ -733,7 +733,7 @@ get_timing_record(struct replay_closure *closure)
 {
     struct timing_closure *timing = &closure->timing;
     int ret;
-    debug_decl(get_timing_record, SUDO_DEBUG_UTIL)
+    debug_decl(get_timing_record, SUDO_DEBUG_UTIL);
 
     if ((ret = iolog_read_timing_record(&iolog_files[IOFD_TIMING], timing)) != 0)
 	debug_return_int(ret);
@@ -764,7 +764,7 @@ get_timing_record(struct replay_closure *closure)
 static void
 next_timing_record(struct replay_closure *closure)
 {
-    debug_decl(next_timing_record, SUDO_DEBUG_UTIL)
+    debug_decl(next_timing_record, SUDO_DEBUG_UTIL);
 
 again:
     switch (get_timing_record(closure)) {
@@ -794,7 +794,7 @@ fill_iobuf(struct replay_closure *closure)
     const size_t space = sizeof(closure->iobuf.buf) - closure->iobuf.len;
     const struct timing_closure *timing = &closure->timing;
     const char *errstr;
-    debug_decl(fill_iobuf, SUDO_DEBUG_UTIL)
+    debug_decl(fill_iobuf, SUDO_DEBUG_UTIL);
 
     if (closure->iobuf.toread != 0 && space != 0) {
 	const size_t len =
@@ -833,7 +833,7 @@ delay_cb(int fd, int what, void *v)
 {
     struct replay_closure *closure = v;
     struct timing_closure *timing = &closure->timing;
-    debug_decl(delay_cb, SUDO_DEBUG_UTIL)
+    debug_decl(delay_cb, SUDO_DEBUG_UTIL);
 
     switch (timing->event) {
     case IO_EVENT_WINSIZE:
@@ -897,7 +897,7 @@ static void
 signal_cb(int signo, int what, void *v)
 {
     struct replay_closure *closure = v;
-    debug_decl(signal_cb, SUDO_DEBUG_UTIL)
+    debug_decl(signal_cb, SUDO_DEBUG_UTIL);
 
     switch (signo) {
     case SIGHUP:
@@ -925,7 +925,7 @@ replay_closure_alloc(int iolog_dir_fd, const char *iolog_dir,
     bool suspend_wait)
 {
     struct replay_closure *closure;
-    debug_decl(replay_closure_alloc, SUDO_DEBUG_UTIL)
+    debug_decl(replay_closure_alloc, SUDO_DEBUG_UTIL);
 
     if ((closure = calloc(1, sizeof(*closure))) == NULL)
 	debug_return_ptr(NULL);
@@ -1012,7 +1012,7 @@ replay_session(int iolog_dir_fd, const char *iolog_dir,
 {
     struct replay_closure *closure;
     int ret = 0;
-    debug_decl(replay_session, SUDO_DEBUG_UTIL)
+    debug_decl(replay_session, SUDO_DEBUG_UTIL);
 
     /* Allocate the delay closure and read the first timing record. */
     closure = replay_closure_alloc(iolog_dir_fd, iolog_dir, max_delay, decimal,
@@ -1046,7 +1046,7 @@ write_output(int fd, int what, void *v)
     struct iovec iov[2];
     bool added_cr = false;
     size_t nbytes, nwritten;
-    debug_decl(write_output, SUDO_DEBUG_UTIL)
+    debug_decl(write_output, SUDO_DEBUG_UTIL);
 
     /* Refill iobuf if there is more to read and buf is empty. */
     if (!fill_iobuf(closure)) {
@@ -1138,7 +1138,7 @@ parse_expr(struct search_node_list *head, char *argv[], bool sub_expr)
     bool or = false, not = false;
     struct search_node *sn;
     char type, **av;
-    debug_decl(parse_expr, SUDO_DEBUG_UTIL)
+    debug_decl(parse_expr, SUDO_DEBUG_UTIL);
 
     for (av = argv; *av != NULL; av++) {
 	switch (av[0][0]) {
@@ -1255,7 +1255,7 @@ match_expr(struct search_node_list *head, struct iolog_info *log, bool last_matc
     struct search_node *sn;
     bool res = false, matched = last_match;
     int rc;
-    debug_decl(match_expr, SUDO_DEBUG_UTIL)
+    debug_decl(match_expr, SUDO_DEBUG_UTIL);
 
     STAILQ_FOREACH(sn, head, entries) {
 	switch (sn->type) {
@@ -1313,7 +1313,7 @@ list_session(char *logfile, regex_t *re, const char *user, const char *tty)
     const char *timestr;
     int ret = -1;
     FILE *fp;
-    debug_decl(list_session, SUDO_DEBUG_UTIL)
+    debug_decl(list_session, SUDO_DEBUG_UTIL);
 
     if ((fp = fopen(logfile, "r")) == NULL) {
 	sudo_warn("%s", logfile);
@@ -1384,7 +1384,7 @@ find_sessions(const char *dir, regex_t *re, const char *user, const char *tty)
 #else
     const bool checked_type = false;
 #endif
-    debug_decl(find_sessions, SUDO_DEBUG_UTIL)
+    debug_decl(find_sessions, SUDO_DEBUG_UTIL);
 
     d = opendir(dir);
     if (d == NULL)
@@ -1466,7 +1466,7 @@ list_sessions(int argc, char **argv, const char *pattern, const char *user,
     const char *tty)
 {
     regex_t rebuf, *re = NULL;
-    debug_decl(list_sessions, SUDO_DEBUG_UTIL)
+    debug_decl(list_sessions, SUDO_DEBUG_UTIL);
 
     /* Parse search expression if present */
     parse_expr(&search_expr, argv, false);
@@ -1493,7 +1493,7 @@ read_keyboard(int fd, int what, void *v)
     struct timespec ts;
     ssize_t nread;
     char ch;
-    debug_decl(read_keyboard, SUDO_DEBUG_UTIL)
+    debug_decl(read_keyboard, SUDO_DEBUG_UTIL);
 
     nread = read(fd, &ch, 1);
     switch (nread) {
diff --git a/plugins/sudoers/testsudoers.c b/plugins/sudoers/testsudoers.c
index d857da355..66b35e2b8 100644
--- a/plugins/sudoers/testsudoers.c
+++ b/plugins/sudoers/testsudoers.c
@@ -121,7 +121,7 @@ main(int argc, char *argv[])
     int match, host_match, runas_match, cmnd_match;
     int ch, dflag, exitcode = EXIT_FAILURE;
     struct sudo_lbuf lbuf;
-    debug_decl(main, SUDOERS_DEBUG_MAIN)
+    debug_decl(main, SUDOERS_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     malloc_options = "S";
@@ -385,7 +385,7 @@ static void
 set_runaspw(const char *user)
 {
     struct passwd *pw = NULL;
-    debug_decl(set_runaspw, SUDOERS_DEBUG_UTIL)
+    debug_decl(set_runaspw, SUDOERS_DEBUG_UTIL);
 
     if (*user == '#') {
 	const char *errstr;
@@ -409,7 +409,7 @@ static void
 set_runasgr(const char *group)
 {
     struct group *gr = NULL;
-    debug_decl(set_runasgr, SUDOERS_DEBUG_UTIL)
+    debug_decl(set_runasgr, SUDOERS_DEBUG_UTIL);
 
     if (*group == '#') {
 	const char *errstr;
@@ -459,7 +459,7 @@ open_sudoers(const char *sudoers, bool doedit, bool *keepopen)
     struct stat sb;
     FILE *fp = NULL;
     char *sudoers_base;
-    debug_decl(open_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(open_sudoers, SUDOERS_DEBUG_UTIL);
 
     sudoers_base = strrchr(sudoers, '/');
     if (sudoers_base != NULL)
@@ -516,7 +516,7 @@ static bool
 print_defaults(struct sudo_lbuf *lbuf)
 {
     struct defaults *def, *next;
-    debug_decl(print_defaults, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_defaults, SUDOERS_DEBUG_UTIL);
 
     TAILQ_FOREACH_SAFE(def, &parsed_policy.defaults, entries, next)
 	sudoers_format_default_line(lbuf, &parsed_policy, def, &next, false);
@@ -529,7 +529,7 @@ print_alias(struct sudoers_parse_tree *parse_tree, struct alias *a, void *v)
 {
     struct sudo_lbuf *lbuf = v;
     struct member *m;
-    debug_decl(print_alias, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_alias, SUDOERS_DEBUG_UTIL);
 
     sudo_lbuf_append(lbuf, "%s %s = ", alias_type_to_string(a->type),
 	a->name);
@@ -546,7 +546,7 @@ print_alias(struct sudoers_parse_tree *parse_tree, struct alias *a, void *v)
 static bool
 print_aliases(struct sudo_lbuf *lbuf)
 {
-    debug_decl(print_aliases, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_aliases, SUDOERS_DEBUG_UTIL);
 
     alias_apply(&parsed_policy, print_alias, lbuf);
 
@@ -556,7 +556,7 @@ print_aliases(struct sudo_lbuf *lbuf)
 static void
 dump_sudoers(struct sudo_lbuf *lbuf)
 {
-    debug_decl(dump_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(dump_sudoers, SUDOERS_DEBUG_UTIL);
 
     /* Print Defaults */
     if (!print_defaults(lbuf))
diff --git a/plugins/sudoers/timeout.c b/plugins/sudoers/timeout.c
index 71796cad3..c86546422 100644
--- a/plugins/sudoers/timeout.c
+++ b/plugins/sudoers/timeout.c
@@ -49,7 +49,7 @@
 int
 parse_timeout(const char *timestr)
 {
-    debug_decl(parse_timeout, SUDOERS_DEBUG_PARSER)
+    debug_decl(parse_timeout, SUDOERS_DEBUG_PARSER);
     const char suffixes[] = "dhms";
     const char *cp = timestr;
     int timeout = 0;
diff --git a/plugins/sudoers/timestamp.c b/plugins/sudoers/timestamp.c
index d315723af..d8047a2a6 100644
--- a/plugins/sudoers/timestamp.c
+++ b/plugins/sudoers/timestamp.c
@@ -81,7 +81,7 @@ static bool
 ts_match_record(struct timestamp_entry *key, struct timestamp_entry *entry,
     unsigned int recno)
 {
-    debug_decl(ts_match_record, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_match_record, SUDOERS_DEBUG_AUTH);
 
     if (entry->version != key->version) {
 	sudo_debug_printf(SUDO_DEBUG_DEBUG,
@@ -155,7 +155,7 @@ ts_find_record(int fd, struct timestamp_entry *key, struct timestamp_entry *entr
 {
     struct timestamp_entry cur;
     unsigned int recno = 0;
-    debug_decl(ts_find_record, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_find_record, SUDOERS_DEBUG_AUTH);
 
     /*
      * Find a matching record (does not match sid or time stamp value).
@@ -197,7 +197,7 @@ ts_mkdirs(char *path, uid_t owner, gid_t group, mode_t mode,
 {
     bool ret;
     mode_t omask;
-    debug_decl(ts_mkdirs, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_mkdirs, SUDOERS_DEBUG_AUTH);
 
     /* umask must not be more restrictive than the file modes. */
     omask = umask(ACCESSPERMS & ~(mode|parent_mode));
@@ -234,7 +234,7 @@ ts_secure_dir(char *path, bool make_it, bool quiet)
 {
     struct stat sb;
     bool ret = false;
-    debug_decl(ts_secure_dir, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_secure_dir, SUDOERS_DEBUG_AUTH);
 
     sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO, "checking %s", path);
     switch (sudo_secure_dir(path, timestamp_uid, -1, &sb)) {
@@ -282,7 +282,7 @@ ts_open(const char *path, int flags)
 {
     bool uid_changed = false;
     int fd;
-    debug_decl(ts_open, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_open, SUDOERS_DEBUG_AUTH);
 
     if (timestamp_uid != 0)
 	uid_changed = set_perms(PERM_TIMESTAMP);
@@ -307,7 +307,7 @@ ts_write(int fd, const char *fname, struct timestamp_entry *entry, off_t offset)
 {
     ssize_t nwritten;
     off_t old_eof;
-    debug_decl(ts_write, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_write, SUDOERS_DEBUG_AUTH);
 
     if (offset == -1) {
 	old_eof = lseek(fd, 0, SEEK_CUR);
@@ -358,7 +358,7 @@ ts_init_key(struct timestamp_entry *entry, struct passwd *pw, int flags,
     enum def_tuple ticket_type)
 {
     struct stat sb;
-    debug_decl(ts_init_key, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_init_key, SUDOERS_DEBUG_AUTH);
 
     memset(entry, 0, sizeof(*entry));
     entry->version = TS_VERSION;
@@ -422,7 +422,7 @@ timestamp_open(const char *user, pid_t sid)
     struct ts_cookie *cookie;
     char *fname = NULL;
     int tries, fd = -1;
-    debug_decl(timestamp_open, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_open, SUDOERS_DEBUG_AUTH);
 
     /* Zero timeout means don't use the time stamp file. */
     if (!sudo_timespecisset(&def_timestamp_timeout)) {
@@ -513,7 +513,7 @@ timestamp_lock_record(int fd, off_t pos, off_t len)
     struct sigaction sa, saveint, savequit;
     sigset_t mask, omask;
     bool ret;
-    debug_decl(timestamp_lock_record, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_lock_record, SUDOERS_DEBUG_AUTH);
 
     if (pos >= 0 && lseek(fd, pos, SEEK_SET) == -1) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO|SUDO_DEBUG_LINENO,
@@ -556,7 +556,7 @@ timestamp_lock_record(int fd, off_t pos, off_t len)
 static bool
 timestamp_unlock_record(int fd, off_t pos, off_t len)
 {
-    debug_decl(timestamp_unlock_record, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_unlock_record, SUDOERS_DEBUG_AUTH);
 
     if (pos >= 0 && lseek(fd, pos, SEEK_SET) == -1) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_ERRNO|SUDO_DEBUG_LINENO,
@@ -574,7 +574,7 @@ ts_read(struct ts_cookie *cookie, struct timestamp_entry *entry)
 {
     ssize_t nread = -1;
     bool should_unlock = false;
-    debug_decl(ts_read, SUDOERS_DEBUG_AUTH)
+    debug_decl(ts_read, SUDOERS_DEBUG_AUTH);
 
     /* If the record is not already locked, lock it now.  */
     if (!cookie->locked) {
@@ -623,7 +623,7 @@ timestamp_lock(void *vcookie, struct passwd *pw)
     struct timestamp_entry entry;
     off_t lock_pos;
     ssize_t nread;
-    debug_decl(timestamp_lock, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_lock, SUDOERS_DEBUG_AUTH);
 
     if (cookie == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_DEBUG|SUDO_DEBUG_LINENO,
@@ -732,7 +732,7 @@ void
 timestamp_close(void *vcookie)
 {
     struct ts_cookie *cookie = vcookie;
-    debug_decl(timestamp_close, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_close, SUDOERS_DEBUG_AUTH);
 
     if (cookie != NULL) {
 	close(cookie->fd);
@@ -758,7 +758,7 @@ timestamp_status(void *vcookie, struct passwd *pw)
     struct timespec diff, now;
     int status = TS_ERROR;		/* assume the worst */
     ssize_t nread;
-    debug_decl(timestamp_status, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_status, SUDOERS_DEBUG_AUTH);
 
     /* Zero timeout means don't use time stamp files. */
     if (!sudo_timespecisset(&def_timestamp_timeout)) {
@@ -884,7 +884,7 @@ timestamp_update(void *vcookie, struct passwd *pw)
 {
     struct ts_cookie *cookie = vcookie;
     int ret = false;
-    debug_decl(timestamp_update, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_update, SUDOERS_DEBUG_AUTH);
 
     /* Zero timeout means don't use time stamp files. */
     if (!sudo_timespecisset(&def_timestamp_timeout)) {
@@ -944,7 +944,7 @@ timestamp_remove(bool unlink_it)
     struct timestamp_entry key, entry;
     int fd = -1, ret = true;
     char *fname = NULL;
-    debug_decl(timestamp_remove, SUDOERS_DEBUG_AUTH)
+    debug_decl(timestamp_remove, SUDOERS_DEBUG_AUTH);
 
 #ifdef TIOCCLRVERAUTH
     if (def_timestamp_type == kernel) {
@@ -1018,7 +1018,7 @@ already_lectured(int unused)
     char status_file[PATH_MAX];
     struct stat sb;
     int len;
-    debug_decl(already_lectured, SUDOERS_DEBUG_AUTH)
+    debug_decl(already_lectured, SUDOERS_DEBUG_AUTH);
 
     if (ts_secure_dir(def_lecture_status_dir, false, true)) {
 	len = snprintf(status_file, sizeof(status_file), "%s/%s",
@@ -1041,7 +1041,7 @@ set_lectured(void)
 {
     char lecture_status[PATH_MAX];
     int len, fd, ret = false;
-    debug_decl(set_lectured, SUDOERS_DEBUG_AUTH)
+    debug_decl(set_lectured, SUDOERS_DEBUG_AUTH);
 
     len = snprintf(lecture_status, sizeof(lecture_status), "%s/%s",
 	def_lecture_status_dir, user_name);
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index f7425a12f..1cd97ad8b 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -4428,7 +4428,7 @@ read_dir_files(const char *dirpath, struct path_list ***pathsp)
     int max_paths = 32;
     struct dirent *dent;
     struct path_list **paths = NULL;
-    debug_decl(read_dir_files, SUDOERS_DEBUG_PARSER)
+    debug_decl(read_dir_files, SUDOERS_DEBUG_PARSER);
 
     dir = opendir(dirpath);
     if (dir == NULL) {
@@ -4509,7 +4509,7 @@ switch_dir(struct include_stack *stack, char *dirpath)
 {
     struct path_list **paths = NULL;
     int count, i;
-    debug_decl(switch_dir, SUDOERS_DEBUG_PARSER)
+    debug_decl(switch_dir, SUDOERS_DEBUG_PARSER);
 
     count = read_dir_files(dirpath, &paths);
     if (count > 0) {
@@ -4537,7 +4537,7 @@ void
 init_lexer(void)
 {
     struct path_list *pl;
-    debug_decl(init_lexer, SUDOERS_DEBUG_PARSER)
+    debug_decl(init_lexer, SUDOERS_DEBUG_PARSER);
 
     while (idepth) {
 	idepth--;
@@ -4575,7 +4575,7 @@ push_include_int(char *path, bool isdir)
 {
     struct path_list *pl;
     FILE *fp;
-    debug_decl(push_include_int, SUDOERS_DEBUG_PARSER)
+    debug_decl(push_include_int, SUDOERS_DEBUG_PARSER);
 
     /* push current state onto stack */
     if (idepth >= istacksize) {
@@ -4675,7 +4675,7 @@ pop_include(void)
 {
     struct path_list *pl;
     FILE *fp;
-    debug_decl(pop_include, SUDOERS_DEBUG_PARSER)
+    debug_decl(pop_include, SUDOERS_DEBUG_PARSER);
 
     if (idepth == 0 || YY_CURRENT_BUFFER == NULL)
 	debug_return_bool(false);
@@ -4718,7 +4718,7 @@ parse_include_int(const char *base, bool isdir)
     char *path, *pp;
     int dirlen = 0, len = 0, subst = 0;
     size_t shost_len = 0;
-    debug_decl(parse_include, SUDOERS_DEBUG_PARSER)
+    debug_decl(parse_include, SUDOERS_DEBUG_PARSER);
 
     /* Pull out path from #include line. */
     cp = base + (isdir ? sizeof("#includedir") : sizeof("#include"));
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index 1fb7eb8f1..668c5b674 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -783,7 +783,7 @@ read_dir_files(const char *dirpath, struct path_list ***pathsp)
     int max_paths = 32;
     struct dirent *dent;
     struct path_list **paths = NULL;
-    debug_decl(read_dir_files, SUDOERS_DEBUG_PARSER)
+    debug_decl(read_dir_files, SUDOERS_DEBUG_PARSER);
 
     dir = opendir(dirpath);
     if (dir == NULL) {
@@ -864,7 +864,7 @@ switch_dir(struct include_stack *stack, char *dirpath)
 {
     struct path_list **paths = NULL;
     int count, i;
-    debug_decl(switch_dir, SUDOERS_DEBUG_PARSER)
+    debug_decl(switch_dir, SUDOERS_DEBUG_PARSER);
 
     count = read_dir_files(dirpath, &paths);
     if (count > 0) {
@@ -892,7 +892,7 @@ void
 init_lexer(void)
 {
     struct path_list *pl;
-    debug_decl(init_lexer, SUDOERS_DEBUG_PARSER)
+    debug_decl(init_lexer, SUDOERS_DEBUG_PARSER);
 
     while (idepth) {
 	idepth--;
@@ -930,7 +930,7 @@ push_include_int(char *path, bool isdir)
 {
     struct path_list *pl;
     FILE *fp;
-    debug_decl(push_include_int, SUDOERS_DEBUG_PARSER)
+    debug_decl(push_include_int, SUDOERS_DEBUG_PARSER);
 
     /* push current state onto stack */
     if (idepth >= istacksize) {
@@ -1030,7 +1030,7 @@ pop_include(void)
 {
     struct path_list *pl;
     FILE *fp;
-    debug_decl(pop_include, SUDOERS_DEBUG_PARSER)
+    debug_decl(pop_include, SUDOERS_DEBUG_PARSER);
 
     if (idepth == 0 || YY_CURRENT_BUFFER == NULL)
 	debug_return_bool(false);
@@ -1073,7 +1073,7 @@ parse_include_int(const char *base, bool isdir)
     char *path, *pp;
     int dirlen = 0, len = 0, subst = 0;
     size_t shost_len = 0;
-    debug_decl(parse_include, SUDOERS_DEBUG_PARSER)
+    debug_decl(parse_include, SUDOERS_DEBUG_PARSER);
 
     /* Pull out path from #include line. */
     cp = base + (isdir ? sizeof("#includedir") : sizeof("#include"));
diff --git a/plugins/sudoers/toke_util.c b/plugins/sudoers/toke_util.c
index a98b375e6..62c9e6948 100644
--- a/plugins/sudoers/toke_util.c
+++ b/plugins/sudoers/toke_util.c
@@ -52,7 +52,7 @@ fill_txt(const char *src, size_t len, size_t olen)
 {
     char *dst;
     int h;
-    debug_decl(fill_txt, SUDOERS_DEBUG_PARSER)
+    debug_decl(fill_txt, SUDOERS_DEBUG_PARSER);
 
     dst = olen ? realloc(sudoerslval.string, olen + len + 1) : malloc(len + 1);
     if (dst == NULL) {
@@ -87,7 +87,7 @@ bool
 append(const char *src, size_t len)
 {
     int olen = 0;
-    debug_decl(append, SUDOERS_DEBUG_PARSER)
+    debug_decl(append, SUDOERS_DEBUG_PARSER);
 
     if (sudoerslval.string != NULL)
 	olen = strlen(sudoerslval.string);
@@ -103,7 +103,7 @@ fill_cmnd(const char *src, size_t len)
 {
     char *dst;
     size_t i;
-    debug_decl(fill_cmnd, SUDOERS_DEBUG_PARSER)
+    debug_decl(fill_cmnd, SUDOERS_DEBUG_PARSER);
 
     arg_len = arg_size = 0;
 
@@ -148,7 +148,7 @@ fill_args(const char *s, size_t len, int addspace)
 {
     unsigned int new_len;
     char *p;
-    debug_decl(fill_args, SUDOERS_DEBUG_PARSER)
+    debug_decl(fill_args, SUDOERS_DEBUG_PARSER);
 
     if (arg_size == 0) {
 	addspace = 0;
@@ -196,7 +196,7 @@ bool
 ipv6_valid(const char *s)
 {
     int nmatch = 0;
-    debug_decl(ipv6_valid, SUDOERS_DEBUG_PARSER)
+    debug_decl(ipv6_valid, SUDOERS_DEBUG_PARSER);
 
     for (; *s != '\0'; s++) {
 	if (s[0] == ':' && s[1] == ':') {
diff --git a/plugins/sudoers/tsdump.c b/plugins/sudoers/tsdump.c
index c103a3ff2..d69c77d8e 100644
--- a/plugins/sudoers/tsdump.c
+++ b/plugins/sudoers/tsdump.c
@@ -75,7 +75,7 @@ main(int argc, char *argv[])
     char *fname = NULL;
     union timestamp_entry_storage cur;
     struct timespec now, timediff;
-    debug_decl(main, SUDOERS_DEBUG_MAIN)
+    debug_decl(main, SUDOERS_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     malloc_options = "S";
@@ -165,7 +165,7 @@ static bool
 valid_entry(union timestamp_entry_storage *u, off_t pos)
 {
     struct timestamp_entry *entry = (struct timestamp_entry *)u;
-    debug_decl(valid_entry, SUDOERS_DEBUG_UTIL)
+    debug_decl(valid_entry, SUDOERS_DEBUG_UTIL);
 
     switch (entry->version) {
     case 1:
@@ -195,7 +195,7 @@ static char *
 type2string(int type)
 {
     static char name[64];
-    debug_decl(type2string, SUDOERS_DEBUG_UTIL)
+    debug_decl(type2string, SUDOERS_DEBUG_UTIL);
 
     switch (type) {
     case TS_LOCKEXCL:
@@ -215,7 +215,7 @@ static void
 print_flags(int flags)
 {
     bool first = true;
-    debug_decl(print_flags, SUDOERS_DEBUG_UTIL)
+    debug_decl(print_flags, SUDOERS_DEBUG_UTIL);
 
     printf("flags: ");
     if (ISSET(flags, TS_DISABLED)) {
@@ -244,7 +244,7 @@ static bool
 convert_entry(union timestamp_entry_storage *record, struct timespec *off)
 {
     union timestamp_entry_storage orig;
-    debug_decl(convert_entry, SUDOERS_DEBUG_UTIL)
+    debug_decl(convert_entry, SUDOERS_DEBUG_UTIL);
 
     if (record->common.version != TS_VERSION) {
 	if (record->common.version != 1) {
@@ -282,7 +282,7 @@ convert_entry(union timestamp_entry_storage *record, struct timespec *off)
 static void
 dump_entry(struct timestamp_entry *entry, off_t pos)
 {
-    debug_decl(dump_entry, SUDOERS_DEBUG_UTIL)
+    debug_decl(dump_entry, SUDOERS_DEBUG_UTIL);
 
     printf("position: %lld\n", (long long)pos);
     printf("version: %hu\n", entry->version);
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index 308c08d63..6a9925bad 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -138,7 +138,7 @@ main(int argc, char *argv[])
     const char *export_path = NULL;
     int ch, oldlocale, editor_argc, exitcode = 0;
     bool quiet, strict, fflag;
-    debug_decl(main, SUDOERS_DEBUG_MAIN)
+    debug_decl(main, SUDOERS_DEBUG_MAIN);
 
 #if defined(SUDO_DEVEL) && defined(__OpenBSD__)
     {
@@ -311,7 +311,7 @@ get_editor(int *editor_argc, char ***editor_argv)
     const char *env_editor;
     static char *files[] = { "+1", "sudoers" };
     unsigned int whitelist_len = 0;
-    debug_decl(get_editor, SUDOERS_DEBUG_UTIL)
+    debug_decl(get_editor, SUDOERS_DEBUG_UTIL);
 
     /* Build up editor whitelist from def_editor unless env_editor is set. */
     if (!def_env_editor) {
@@ -390,7 +390,7 @@ editor_supports_plus(const char *editor)
     const char *editor_base = strrchr(editor, '/');
     const char *cp;
     char **av;
-    debug_decl(editor_supports_plus, SUDOERS_DEBUG_UTIL)
+    debug_decl(editor_supports_plus, SUDOERS_DEBUG_UTIL);
 
     if (editor_base != NULL)
 	editor_base++;
@@ -431,7 +431,7 @@ edit_sudoers(struct sudoersfile *sp, char *editor, int editor_argc,
     off_t orig_size;			/* starting size of sudoers file */
     struct stat sb;			/* stat buffer */
     bool ret = false;			/* return value */
-    debug_decl(edit_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(edit_sudoers, SUDOERS_DEBUG_UTIL);
 
     if (fstat(sp->fd, &sb) == -1)
 	sudo_fatal(U_("unable to stat %s"), sp->path);
@@ -557,7 +557,7 @@ done:
 static void
 check_defaults_and_aliases(bool strict, bool quiet)
 {
-    debug_decl(check_defaults_and_aliases, SUDOERS_DEBUG_UTIL)
+    debug_decl(check_defaults_and_aliases, SUDOERS_DEBUG_UTIL);
 
     if (!check_defaults(&parsed_policy, quiet)) {
 	struct defaults *d;
@@ -593,7 +593,7 @@ reparse_sudoers(char *editor, int editor_argc, char **editor_argv,
     struct sudoersfile *sp, *last;
     FILE *fp;
     int ch, oldlocale;
-    debug_decl(reparse_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(reparse_sudoers, SUDOERS_DEBUG_UTIL);
 
     /*
      * Parse the edited sudoers files and do sanity checking
@@ -693,7 +693,7 @@ install_sudoers(struct sudoersfile *sp, bool oldperms)
 {
     struct stat sb;
     bool ret = false;
-    debug_decl(install_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(install_sudoers, SUDOERS_DEBUG_UTIL);
 
     if (sp->tpath == NULL)
 	goto done;
@@ -806,7 +806,7 @@ static int
 whatnow(void)
 {
     int choice, c;
-    debug_decl(whatnow, SUDOERS_DEBUG_UTIL)
+    debug_decl(whatnow, SUDOERS_DEBUG_UTIL);
 
     for (;;) {
 	(void) fputs(_("What now? "), stdout);
@@ -838,7 +838,7 @@ static void
 setup_signals(void)
 {
     struct sigaction sa;
-    debug_decl(setup_signals, SUDOERS_DEBUG_UTIL)
+    debug_decl(setup_signals, SUDOERS_DEBUG_UTIL);
 
     /*
      * Setup signal handlers to cleanup nicely.
@@ -860,7 +860,7 @@ run_command(char *path, char **argv)
 {
     int status;
     pid_t pid, rv;
-    debug_decl(run_command, SUDOERS_DEBUG_UTIL)
+    debug_decl(run_command, SUDOERS_DEBUG_UTIL);
 
     switch (pid = sudo_debug_fork()) {
 	case -1:
@@ -892,7 +892,7 @@ check_owner(const char *path, bool quiet)
 {
     struct stat sb;
     bool ok = true;
-    debug_decl(check_owner, SUDOERS_DEBUG_UTIL)
+    debug_decl(check_owner, SUDOERS_DEBUG_UTIL);
 
     if (stat(path, &sb) == 0) {
 	if (sb.st_uid != sudoers_uid || sb.st_gid != sudoers_gid) {
@@ -919,7 +919,7 @@ check_syntax(const char *sudoers_file, bool quiet, bool strict, bool oldperms)
 {
     bool ok = false;
     int oldlocale;
-    debug_decl(check_syntax, SUDOERS_DEBUG_UTIL)
+    debug_decl(check_syntax, SUDOERS_DEBUG_UTIL);
 
     if (strcmp(sudoers_file, "-") == 0) {
 	sudoersin = stdin;
@@ -985,7 +985,7 @@ static bool
 lock_sudoers(struct sudoersfile *entry)
 {
     int ch;
-    debug_decl(lock_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(lock_sudoers, SUDOERS_DEBUG_UTIL);
 
     if (!sudo_lock_file(entry->fd, SUDO_TLOCK)) {
 	if (errno == EAGAIN || errno == EWOULDBLOCK) {
@@ -1011,7 +1011,7 @@ open_sudoers(const char *path, bool doedit, bool *keepopen)
     struct sudoersfile *entry;
     FILE *fp;
     int open_flags;
-    debug_decl(open_sudoers, SUDOERS_DEBUG_UTIL)
+    debug_decl(open_sudoers, SUDOERS_DEBUG_UTIL);
 
     if (checkonly)
 	open_flags = O_RDONLY;
@@ -1063,7 +1063,7 @@ check_alias(char *name, int type, char *file, int lineno, bool strict, bool quie
     struct member *m;
     struct alias *a;
     int errors = 0;
-    debug_decl(check_alias, SUDOERS_DEBUG_ALIAS)
+    debug_decl(check_alias, SUDOERS_DEBUG_ALIAS);
 
     if ((a = alias_get(&parsed_policy, name, type)) != NULL) {
 	/* check alias contents */
@@ -1111,7 +1111,7 @@ check_aliases(bool strict, bool quiet)
     struct privilege *priv;
     struct userspec *us;
     int errors = 0;
-    debug_decl(check_aliases, SUDOERS_DEBUG_ALIAS)
+    debug_decl(check_aliases, SUDOERS_DEBUG_ALIAS);
 
     used_aliases = alloc_aliases();
     if (used_aliases == NULL) {
@@ -1184,7 +1184,7 @@ static void
 parse_sudoers_options(void)
 {
     struct plugin_info_list *plugins;
-    debug_decl(parse_sudoers_options, SUDOERS_DEBUG_UTIL)
+    debug_decl(parse_sudoers_options, SUDOERS_DEBUG_UTIL);
 
     plugins = sudo_conf_plugins();
     if (plugins) {
diff --git a/src/exec.c b/src/exec.c
index 0a0e85a07..8e51dd23b 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -60,7 +60,7 @@ close_fds(struct command_details *details, int errfd)
 {
     int fd, maxfd;
     unsigned char *debug_fds;
-    debug_decl(close_fds, SUDO_DEBUG_EXEC)
+    debug_decl(close_fds, SUDO_DEBUG_EXEC);
 
     if (details->closefrom < 0)
 	debug_return;
@@ -89,7 +89,7 @@ static bool
 exec_setup(struct command_details *details, int errfd)
 {
     bool ret = false;
-    debug_decl(exec_setup, SUDO_DEBUG_EXEC)
+    debug_decl(exec_setup, SUDO_DEBUG_EXEC);
 
     if (details->pw != NULL) {
 #ifdef HAVE_PROJECT_H
@@ -239,7 +239,7 @@ done:
 void
 exec_cmnd(struct command_details *details, int errfd)
 {
-    debug_decl(exec_cmnd, SUDO_DEBUG_EXEC)
+    debug_decl(exec_cmnd, SUDO_DEBUG_EXEC);
 
     restore_signals();
     if (exec_setup(details, errfd) == true) {
@@ -270,7 +270,7 @@ sudo_terminated(struct command_status *cstat)
 {
     int signo;
     bool sigtstp = false;
-    debug_decl(sudo_terminated, SUDO_DEBUG_EXEC)
+    debug_decl(sudo_terminated, SUDO_DEBUG_EXEC);
 
     for (signo = 0; signo < NSIG; signo++) {
 	if (signal_pending(signo)) {
@@ -346,7 +346,7 @@ sudo_needs_pty(struct command_details *details)
 int
 sudo_execute(struct command_details *details, struct command_status *cstat)
 {
-    debug_decl(sudo_execute, SUDO_DEBUG_EXEC)
+    debug_decl(sudo_execute, SUDO_DEBUG_EXEC);
 
     /* If running in background mode, fork and exit. */
     if (ISSET(details->flags, CD_BACKGROUND)) {
diff --git a/src/exec_common.c b/src/exec_common.c
index 7b5a0886f..24bac9f55 100644
--- a/src/exec_common.c
+++ b/src/exec_common.c
@@ -59,7 +59,7 @@ preload_dso(char *envp[], const char *dso_file)
 # else
     const bool enabled = true;
 # endif
-    debug_decl(preload_dso, SUDO_DEBUG_UTIL)
+    debug_decl(preload_dso, SUDO_DEBUG_UTIL);
 
     /*
      * Preload a DSO file.  For a list of LD_PRELOAD-alikes, see
@@ -161,7 +161,7 @@ preload_dso(char *envp[], const char *dso_file)
 char **
 disable_execute(char *envp[], const char *dso)
 {
-    debug_decl(disable_execute, SUDO_DEBUG_UTIL)
+    debug_decl(disable_execute, SUDO_DEBUG_UTIL);
 
 #ifdef HAVE_PRIV_SET
     /* Solaris privileges, remove PRIV_PROC_EXEC post-execve. */
@@ -188,7 +188,7 @@ disable_execute(char *envp[], const char *dso)
 int
 sudo_execve(int fd, const char *path, char *const argv[], char *envp[], bool noexec)
 {
-    debug_decl(sudo_execve, SUDO_DEBUG_UTIL)
+    debug_decl(sudo_execve, SUDO_DEBUG_UTIL);
 
     sudo_debug_execve(SUDO_DEBUG_INFO, path, argv, envp);
 
diff --git a/src/exec_nopty.c b/src/exec_nopty.c
index de02d5fbc..577e7b2ce 100644
--- a/src/exec_nopty.c
+++ b/src/exec_nopty.c
@@ -118,7 +118,7 @@ signal_cb_nopty(int signo, int what, void *v)
     struct sudo_ev_siginfo_container *sc = v;
     struct exec_closure_nopty *ec = sc->closure;
     char signame[SIG2STR_MAX];
-    debug_decl(signal_cb_nopty, SUDO_DEBUG_EXEC)
+    debug_decl(signal_cb_nopty, SUDO_DEBUG_EXEC);
 
     if (ec->cmnd_pid == -1)
 	debug_return;
@@ -200,7 +200,7 @@ static void
 fill_exec_closure_nopty(struct exec_closure_nopty *ec,
     struct command_status *cstat, struct command_details *details, int errfd)
 {
-    debug_decl(fill_exec_closure_nopty, SUDO_DEBUG_EXEC)
+    debug_decl(fill_exec_closure_nopty, SUDO_DEBUG_EXEC);
 
     /* Fill in the non-event part of the closure. */
     ec->ppgrp = getpgrp();
@@ -319,7 +319,7 @@ fill_exec_closure_nopty(struct exec_closure_nopty *ec,
 static void
 free_exec_closure_nopty(struct exec_closure_nopty *ec)
 {
-    debug_decl(free_exec_closure_nopty, SUDO_DEBUG_EXEC)
+    debug_decl(free_exec_closure_nopty, SUDO_DEBUG_EXEC);
 
     sudo_ev_base_free(ec->evbase);
     sudo_ev_free(ec->errpipe_event);
@@ -348,7 +348,7 @@ exec_nopty(struct command_details *details, struct command_status *cstat)
     struct exec_closure_nopty ec = { 0 };
     sigset_t set, oset;
     int errpipe[2];
-    debug_decl(exec_nopty, SUDO_DEBUG_EXEC)
+    debug_decl(exec_nopty, SUDO_DEBUG_EXEC);
 
     /*
      * The policy plugin's session init must be run before we fork
@@ -465,7 +465,7 @@ handle_sigchld_nopty(struct exec_closure_nopty *ec)
     pid_t pid;
     int status;
     char signame[SIG2STR_MAX];
-    debug_decl(handle_sigchld_nopty, SUDO_DEBUG_EXEC)
+    debug_decl(handle_sigchld_nopty, SUDO_DEBUG_EXEC);
 
     /* Read command status. */
     do {
diff --git a/src/exec_pty.c b/src/exec_pty.c
index 8fe57950a..287c5bb54 100644
--- a/src/exec_pty.c
+++ b/src/exec_pty.c
@@ -845,7 +845,7 @@ static void
 send_command_status(struct exec_closure_pty *ec, int type, int val)
 {
     struct monitor_message *msg;
-    debug_decl(send_command, SUDO_DEBUG_EXEC)
+    debug_decl(send_command, SUDO_DEBUG_EXEC);
 
     if ((msg = calloc(1, sizeof(*msg))) == NULL)
 	sudo_fatalx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
@@ -869,7 +869,7 @@ static void
 schedule_signal(struct exec_closure_pty *ec, int signo)
 {
     char signame[SIG2STR_MAX];
-    debug_decl(schedule_signal, SUDO_DEBUG_EXEC)
+    debug_decl(schedule_signal, SUDO_DEBUG_EXEC);
 
     if (signo == SIGCONT_FG)
 	strlcpy(signame, "CONT_FG", sizeof(signame));
@@ -890,7 +890,7 @@ backchannel_cb(int fd, int what, void *v)
     struct exec_closure_pty *ec = v;
     struct command_status cstat;
     ssize_t nread;
-    debug_decl(backchannel_cb, SUDO_DEBUG_EXEC)
+    debug_decl(backchannel_cb, SUDO_DEBUG_EXEC);
 
     /*
      * Read command status from the monitor.
@@ -985,7 +985,7 @@ handle_sigchld_pty(struct exec_closure_pty *ec)
 {
     int n, status;
     pid_t pid;
-    debug_decl(handle_sigchld_pty, SUDO_DEBUG_EXEC)
+    debug_decl(handle_sigchld_pty, SUDO_DEBUG_EXEC);
 
     /*
      * Monitor process was signaled; wait for it as needed.
@@ -1037,7 +1037,7 @@ signal_cb_pty(int signo, int what, void *v)
     struct sudo_ev_siginfo_container *sc = v;
     struct exec_closure_pty *ec = sc->closure;
     char signame[SIG2STR_MAX];
-    debug_decl(signal_cb_pty, SUDO_DEBUG_EXEC)
+    debug_decl(signal_cb_pty, SUDO_DEBUG_EXEC);
 
     if (ec->monitor_pid == -1)
 	debug_return;
@@ -1090,7 +1090,7 @@ fwdchannel_cb(int sock, int what, void *v)
     char signame[SIG2STR_MAX];
     struct monitor_message *msg;
     ssize_t nsent;
-    debug_decl(fwdchannel_cb, SUDO_DEBUG_EXEC)
+    debug_decl(fwdchannel_cb, SUDO_DEBUG_EXEC);
 
     while ((msg = TAILQ_FIRST(&ec->monitor_messages)) != NULL) {
 	switch (msg->cstat.type) {
@@ -1147,7 +1147,7 @@ static void
 fill_exec_closure_pty(struct exec_closure_pty *ec, struct command_status *cstat,
     struct command_details *details, pid_t ppgrp, int backchannel)
 {
-    debug_decl(fill_exec_closure_pty, SUDO_DEBUG_EXEC)
+    debug_decl(fill_exec_closure_pty, SUDO_DEBUG_EXEC);
 
     /* Fill in the non-event part of the closure. */
     ec->cmnd_pid = -1;
@@ -1261,7 +1261,7 @@ static void
 free_exec_closure_pty(struct exec_closure_pty *ec)
 {
     struct monitor_message *msg;
-    debug_decl(free_exec_closure_pty, SUDO_DEBUG_EXEC)
+    debug_decl(free_exec_closure_pty, SUDO_DEBUG_EXEC);
 
     sudo_ev_base_free(ec->evbase);
     sudo_ev_free(ec->backchannel_event);
@@ -1303,7 +1303,7 @@ exec_pty(struct command_details *details, struct command_status *cstat)
     struct stat sb;
     pid_t ppgrp;
     int sv[2];
-    debug_decl(exec_pty, SUDO_DEBUG_EXEC)
+    debug_decl(exec_pty, SUDO_DEBUG_EXEC);
 
     /*
      * Allocate a pty.
diff --git a/src/get_pty.c b/src/get_pty.c
index 968e4cdfc..3b727c991 100644
--- a/src/get_pty.c
+++ b/src/get_pty.c
@@ -62,7 +62,7 @@ get_pty(int *master, int *slave, char *name, size_t namesz, uid_t ttyuid)
     struct group *gr;
     gid_t ttygid = -1;
     bool ret = false;
-    debug_decl(get_pty, SUDO_DEBUG_PTY)
+    debug_decl(get_pty, SUDO_DEBUG_PTY);
 
     if ((gr = getgrnam("tty")) != NULL)
 	ttygid = gr->gr_gid;
@@ -81,7 +81,7 @@ get_pty(int *master, int *slave, char *name, size_t namesz, uid_t ttyuid)
 {
     char *line;
     bool ret = false;
-    debug_decl(get_pty, SUDO_DEBUG_PTY)
+    debug_decl(get_pty, SUDO_DEBUG_PTY);
 
     /* IRIX-style dynamic ptys (may fork) */
     line = _getpty(master, O_RDWR, S_IRUSR|S_IWUSR|S_IWGRP, 0);
@@ -119,7 +119,7 @@ get_pty(int *master, int *slave, char *name, size_t namesz, uid_t ttyuid)
 {
     char *line;
     bool ret = false;
-    debug_decl(get_pty, SUDO_DEBUG_PTY)
+    debug_decl(get_pty, SUDO_DEBUG_PTY);
 
     *master = posix_openpt(O_RDWR|O_NOCTTY);
     if (*master != -1) {
@@ -161,7 +161,7 @@ get_pty(int *master, int *slave, char *name, size_t namesz, uid_t ttyuid)
     struct group *gr;
     gid_t ttygid = -1;
     bool ret = false;
-    debug_decl(get_pty, SUDO_DEBUG_PTY)
+    debug_decl(get_pty, SUDO_DEBUG_PTY);
 
     if ((gr = getgrnam("tty")) != NULL)
 	ttygid = gr->gr_gid;
diff --git a/src/hooks.c b/src/hooks.c
index 97b114f9a..01078ae4c 100644
--- a/src/hooks.c
+++ b/src/hooks.c
@@ -136,7 +136,7 @@ register_hook_internal(struct sudo_hook_list *head,
     int (*hook_fn)(), void *closure)
 {
     struct sudo_hook_entry *hook;
-    debug_decl(register_hook_internal, SUDO_DEBUG_HOOKS)
+    debug_decl(register_hook_internal, SUDO_DEBUG_HOOKS);
 
     if ((hook = calloc(1, sizeof(*hook))) == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_ERROR|SUDO_DEBUG_LINENO,
@@ -155,7 +155,7 @@ int
 register_hook(struct sudo_hook *hook)
 {
     int ret;
-    debug_decl(register_hook, SUDO_DEBUG_HOOKS)
+    debug_decl(register_hook, SUDO_DEBUG_HOOKS);
 
     if (SUDO_API_VERSION_GET_MAJOR(hook->hook_version) != SUDO_HOOK_VERSION_MAJOR) {
 	/* Major versions must match. */
@@ -196,7 +196,7 @@ deregister_hook_internal(struct sudo_hook_list *head,
     int (*hook_fn)(), void *closure)
 {
     struct sudo_hook_entry *hook, *prev = NULL;
-    debug_decl(deregister_hook_internal, SUDO_DEBUG_HOOKS)
+    debug_decl(deregister_hook_internal, SUDO_DEBUG_HOOKS);
 
     SLIST_FOREACH(hook, head, entries) {
 	if (hook->u.generic_fn == hook_fn && hook->closure == closure) {
@@ -219,7 +219,7 @@ int
 deregister_hook(struct sudo_hook *hook)
 {
     int ret = 0;
-    debug_decl(deregister_hook, SUDO_DEBUG_HOOKS)
+    debug_decl(deregister_hook, SUDO_DEBUG_HOOKS);
 
     if (SUDO_API_VERSION_GET_MAJOR(hook->hook_version) != SUDO_HOOK_VERSION_MAJOR) {
 	/* Major versions must match. */
diff --git a/src/limits.c b/src/limits.c
index 8d7bfbafe..32623c857 100644
--- a/src/limits.c
+++ b/src/limits.c
@@ -94,7 +94,7 @@ void
 disable_coredump(void)
 {
     struct rlimit rl = { 0, 0 };
-    debug_decl(disable_coredump, SUDO_DEBUG_UTIL)
+    debug_decl(disable_coredump, SUDO_DEBUG_UTIL);
 
     if (getrlimit(RLIMIT_CORE, &corelimit) == -1)
 	sudo_warn("getrlimit(RLIMIT_CORE)");
@@ -117,7 +117,7 @@ disable_coredump(void)
 static void
 restore_coredump(void)
 {
-    debug_decl(restore_coredump, SUDO_DEBUG_UTIL)
+    debug_decl(restore_coredump, SUDO_DEBUG_UTIL);
 
     if (coredump_disabled) {
 	if (setrlimit(RLIMIT_CORE, &corelimit) == -1)
@@ -142,7 +142,7 @@ unlimit_nproc(void)
 {
 #ifdef __linux__
     struct rlimit rl = { RLIM_INFINITY, RLIM_INFINITY };
-    debug_decl(unlimit_nproc, SUDO_DEBUG_UTIL)
+    debug_decl(unlimit_nproc, SUDO_DEBUG_UTIL);
 
     if (getrlimit(RLIMIT_NPROC, &nproclimit) != 0)
 	sudo_warn("getrlimit(RLIMIT_NPROC)");
@@ -162,7 +162,7 @@ void
 restore_nproc(void)
 {
 #ifdef __linux__
-    debug_decl(restore_nproc, SUDO_DEBUG_UTIL)
+    debug_decl(restore_nproc, SUDO_DEBUG_UTIL);
 
     if (setrlimit(RLIMIT_NPROC, &nproclimit) != 0)
 	sudo_warn("setrlimit(RLIMIT_NPROC)");
@@ -180,7 +180,7 @@ unlimit_sudo(void)
 {
     unsigned int idx;
     int rc;
-    debug_decl(unlimit_sudo, SUDO_DEBUG_UTIL)
+    debug_decl(unlimit_sudo, SUDO_DEBUG_UTIL);
 
     /* Set resource limits to unlimited and stash the old values. */
     for (idx = 0; idx < nitems(saved_limits); idx++) {
@@ -224,7 +224,7 @@ void
 restore_limits(void)
 {
     unsigned int idx;
-    debug_decl(restore_limits, SUDO_DEBUG_UTIL)
+    debug_decl(restore_limits, SUDO_DEBUG_UTIL);
 
     /* Restore resource limits to saved values. */
     for (idx = 0; idx < nitems(saved_limits); idx++) {
diff --git a/src/load_plugins.c b/src/load_plugins.c
index 14a2ae539..f5065806a 100644
--- a/src/load_plugins.c
+++ b/src/load_plugins.c
@@ -50,7 +50,7 @@ sudo_stat_plugin(struct plugin_info *info, char *fullpath,
     size_t pathsize, struct stat *sb)
 {
     int status = -1;
-    debug_decl(sudo_stat_plugin, SUDO_DEBUG_PLUGIN)
+    debug_decl(sudo_stat_plugin, SUDO_DEBUG_PLUGIN);
 
     if (info->path[0] == '/') {
 	if (strlcpy(fullpath, info->path, pathsize) >= pathsize) {
@@ -116,7 +116,7 @@ sudo_check_plugin(struct plugin_info *info, char *fullpath, size_t pathsize)
 {
     struct stat sb;
     bool ret = false;
-    debug_decl(sudo_check_plugin, SUDO_DEBUG_PLUGIN)
+    debug_decl(sudo_check_plugin, SUDO_DEBUG_PLUGIN);
 
     if (sudo_stat_plugin(info, fullpath, pathsize, &sb) != 0) {
 	sudo_warnx(U_("error in %s, line %d while loading plugin \"%s\""),
@@ -154,7 +154,7 @@ done:
 static bool
 sudo_check_plugin(struct plugin_info *info, char *fullpath, size_t pathsize)
 {
-    debug_decl(sudo_check_plugin, SUDO_DEBUG_PLUGIN)
+    debug_decl(sudo_check_plugin, SUDO_DEBUG_PLUGIN);
     (void)strlcpy(fullpath, info->path, pathsize);
     debug_return_bool(true);
 }
@@ -171,7 +171,7 @@ sudo_load_plugin(struct plugin_container *policy_plugin,
     struct generic_plugin *plugin;
     char path[PATH_MAX];
     void *handle = NULL;
-    debug_decl(sudo_load_plugin, SUDO_DEBUG_PLUGIN)
+    debug_decl(sudo_load_plugin, SUDO_DEBUG_PLUGIN);
 
     /* Sanity check plugin and fill in path */
     if (!sudo_check_plugin(info, path, sizeof(path)))
@@ -295,7 +295,7 @@ sudo_load_plugins(struct plugin_container *policy_plugin,
     struct plugin_info_list *plugins;
     struct plugin_info *info, *next;
     bool ret = false;
-    debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN)
+    debug_decl(sudo_load_plugins, SUDO_DEBUG_PLUGIN);
 
     /* Walk the plugin list from sudo.conf, if any and free it. */
     plugins = sudo_conf_plugins();
diff --git a/src/net_ifs.c b/src/net_ifs.c
index 9014b652a..814c6065d 100644
--- a/src/net_ifs.c
+++ b/src/net_ifs.c
@@ -126,7 +126,7 @@ get_net_ifs(char **addrinfo)
 #endif
     int ailen, len, num_interfaces = 0;
     char *cp;
-    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF)
+    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF);
 
     if (!sudo_conf_probe_interfaces())
 	debug_return_int(0);
@@ -235,7 +235,7 @@ get_net_ifs(char **addrinfo)
 #ifdef _ISC
     struct strioctl strioctl;
 #endif /* _ISC */
-    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF)
+    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF);
 
     if (!sudo_conf_probe_interfaces())
 	debug_return_int(0);
@@ -367,7 +367,7 @@ done:
 int
 get_net_ifs(char **addrinfo)
 {
-    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF)
+    debug_decl(get_net_ifs, SUDO_DEBUG_NETIF);
     debug_return_int(0);
 }
 
diff --git a/src/parse_args.c b/src/parse_args.c
index f87035923..d1abed696 100644
--- a/src/parse_args.c
+++ b/src/parse_args.c
@@ -173,7 +173,7 @@ static struct option long_opts[] = {
 static void
 env_insert(struct environment *e, char *pair)
 {
-    debug_decl(env_insert, SUDO_DEBUG_ARGS)
+    debug_decl(env_insert, SUDO_DEBUG_ARGS);
 
     /* Make sure we have at least two slots free (one for NULL). */
     if (e->env_len + 1 >= e->env_size) {
@@ -200,7 +200,7 @@ static void
 env_set(struct environment *e, char *var, char *val)
 {
     char *pair;
-    debug_decl(env_set, SUDO_DEBUG_ARGS)
+    debug_decl(env_set, SUDO_DEBUG_ARGS);
 
     pair = sudo_new_key_val(var, val);
     if (pair == NULL) {
@@ -220,7 +220,7 @@ static void
 parse_env_list(struct environment *e, char *list)
 {
     char *cp, *last, *val;
-    debug_decl(parse_env_list, SUDO_DEBUG_ARGS)
+    debug_decl(parse_env_list, SUDO_DEBUG_ARGS);
 
     for ((cp = strtok_r(list, ",", &last)); cp != NULL;
 	(cp = strtok_r(NULL, ",", &last))) {
@@ -253,7 +253,7 @@ parse_args(int argc, char **argv, int *nargc, char ***nargv,
     const char *runas_group = NULL;
     const char *progname;
     int proglen;
-    debug_decl(parse_args, SUDO_DEBUG_ARGS)
+    debug_decl(parse_args, SUDO_DEBUG_ARGS);
 
     /* Is someone trying something funny? */
     if (argc <= 0)
@@ -695,7 +695,7 @@ usage(int fatal)
 static void
 usage_excl(int fatal)
 {
-    debug_decl(usage_excl, SUDO_DEBUG_ARGS)
+    debug_decl(usage_excl, SUDO_DEBUG_ARGS);
 
     sudo_warnx(U_("Only one of the -e, -h, -i, -K, -l, -s, -v or -V options may be specified"));
     usage(fatal);
@@ -707,7 +707,7 @@ help(void)
     struct sudo_lbuf lbuf;
     const int indent = 32;
     const char *pname = getprogname();
-    debug_decl(help, SUDO_DEBUG_ARGS)
+    debug_decl(help, SUDO_DEBUG_ARGS);
 
     sudo_lbuf_init(&lbuf, usage_out, indent, NULL, user_details.ts_cols);
     if (strcmp(pname, "sudoedit") == 0)
diff --git a/src/preserve_fds.c b/src/preserve_fds.c
index 21674acea..4823059c1 100644
--- a/src/preserve_fds.c
+++ b/src/preserve_fds.c
@@ -47,7 +47,7 @@ int
 add_preserved_fd(struct preserved_fd_list *pfds, int fd)
 {
     struct preserved_fd *pfd, *pfd_new;
-    debug_decl(add_preserved_fd, SUDO_DEBUG_UTIL)
+    debug_decl(add_preserved_fd, SUDO_DEBUG_UTIL);
 
     pfd_new = malloc(sizeof(*pfd));
     if (pfd_new == NULL)
@@ -96,7 +96,7 @@ closefrom_except(int startfd, struct preserved_fd_list *pfds)
     int fd, lastfd = -1;
     struct preserved_fd *pfd, *pfd_next;
     unsigned char *fdbits;
-    debug_decl(closefrom_except, SUDO_DEBUG_UTIL)
+    debug_decl(closefrom_except, SUDO_DEBUG_UTIL);
 
     /* First, relocate preserved fds to be as contiguous as possible.  */
     TAILQ_FOREACH_REVERSE_SAFE(pfd, pfds, preserved_fd_list, entries, pfd_next) {
@@ -201,7 +201,7 @@ parse_preserved_fds(struct preserved_fd_list *pfds, const char *fdstr)
     const char *cp = fdstr;
     long lval;
     char *ep;
-    debug_decl(parse_preserved_fds, SUDO_DEBUG_UTIL)
+    debug_decl(parse_preserved_fds, SUDO_DEBUG_UTIL);
 
     do {
 	errno = 0;
diff --git a/src/selinux.c b/src/selinux.c
index 5e8bcdc84..9be57f92c 100644
--- a/src/selinux.c
+++ b/src/selinux.c
@@ -75,7 +75,7 @@ audit_role_change(const security_context_t old_context,
 {
     int au_fd, rc = -1;
     char *message;
-    debug_decl(audit_role_change, SUDO_DEBUG_SELINUX)
+    debug_decl(audit_role_change, SUDO_DEBUG_SELINUX);
 
     au_fd = audit_open();
     if (au_fd == -1) {
@@ -113,7 +113,7 @@ selinux_restore_tty(void)
 {
     int ret = -1;
     security_context_t chk_tty_con_raw = NULL;
-    debug_decl(selinux_restore_tty, SUDO_DEBUG_SELINUX)
+    debug_decl(selinux_restore_tty, SUDO_DEBUG_SELINUX);
 
     if (se_state.ttyfd == -1 || se_state.new_tty_con_raw == NULL) {
 	sudo_debug_printf(SUDO_DEBUG_INFO, "%s: no tty, skip relabel",
@@ -171,7 +171,7 @@ relabel_tty(const char *ttyn, int ptyfd)
     security_context_t new_tty_con = NULL;
     struct stat sb;
     int fd;
-    debug_decl(relabel_tty, SUDO_DEBUG_SELINUX)
+    debug_decl(relabel_tty, SUDO_DEBUG_SELINUX);
 
     se_state.ttyfd = ptyfd;
 
@@ -315,7 +315,7 @@ get_exec_context(security_context_t old_context, const char *role, const char *t
     security_context_t new_context = NULL;
     context_t context = NULL;
     char *typebuf = NULL;
-    debug_decl(get_exec_context, SUDO_DEBUG_SELINUX)
+    debug_decl(get_exec_context, SUDO_DEBUG_SELINUX);
     
     /* We must have a role, the type is optional (we can use the default). */
     if (role == NULL) {
@@ -390,7 +390,7 @@ selinux_setup(const char *role, const char *type, const char *ttyn,
     int ptyfd)
 {
     int ret = -1;
-    debug_decl(selinux_setup, SUDO_DEBUG_SELINUX)
+    debug_decl(selinux_setup, SUDO_DEBUG_SELINUX);
 
     /* Store the caller's SID in old_context. */
     if (getprevcon(&se_state.old_context)) {
@@ -439,7 +439,7 @@ selinux_execve(int fd, const char *path, char *const argv[], char *envp[],
     char **nargv;
     const char *sesh;
     int argc, nargc, serrno;
-    debug_decl(selinux_execve, SUDO_DEBUG_SELINUX)
+    debug_decl(selinux_execve, SUDO_DEBUG_SELINUX);
 
     sesh = sudo_conf_sesh_path();
     if (sesh == NULL) {
diff --git a/src/sesh.c b/src/sesh.c
index c3b8b135f..6d2f5f58c 100644
--- a/src/sesh.c
+++ b/src/sesh.c
@@ -67,7 +67,7 @@ int
 main(int argc, char *argv[], char *envp[])
 {
     int ret;
-    debug_decl(main, SUDO_DEBUG_MAIN)
+    debug_decl(main, SUDO_DEBUG_MAIN);
 
     initprogname(argc > 0 ? argv[0] : "sesh");
 
@@ -140,7 +140,7 @@ sesh_sudoedit(int argc, char *argv[])
     struct stat sb;
     struct timespec times[2];
     char buf[BUFSIZ];
-    debug_decl(sesh_sudoedit, SUDO_DEBUG_EDIT)
+    debug_decl(sesh_sudoedit, SUDO_DEBUG_EDIT);
 
     /* Check for -h flag (don't follow links). */
     if (strcmp(argv[2], "-h") == 0) {
diff --git a/src/signal.c b/src/signal.c
index efae397c5..80bc1d82b 100644
--- a/src/signal.c
+++ b/src/signal.c
@@ -83,7 +83,7 @@ void
 save_signals(void)
 {
     struct signal_state *ss;
-    debug_decl(save_signals, SUDO_DEBUG_MAIN)
+    debug_decl(save_signals, SUDO_DEBUG_MAIN);
 
     for (ss = saved_signals; ss->signo != -1; ss++) {
 	if (sigaction(ss->signo, NULL, &ss->sa) != 0)
@@ -100,7 +100,7 @@ void
 restore_signals(void)
 {
     struct signal_state *ss;
-    debug_decl(restore_signals, SUDO_DEBUG_MAIN)
+    debug_decl(restore_signals, SUDO_DEBUG_MAIN);
 
     for (ss = saved_signals; ss->signo != -1; ss++) {
 	if (ss->restore) {
@@ -129,7 +129,7 @@ init_signals(void)
 {
     struct sigaction sa;
     struct signal_state *ss;
-    debug_decl(init_signals, SUDO_DEBUG_MAIN)
+    debug_decl(init_signals, SUDO_DEBUG_MAIN);
 
     memset(&sa, 0, sizeof(sa));
     sigfillset(&sa.sa_mask);
@@ -176,7 +176,7 @@ sudo_sigaction(int signo, struct sigaction *sa, struct sigaction *osa)
 {
     struct signal_state *ss;
     int ret;
-    debug_decl(sudo_sigaction, SUDO_DEBUG_MAIN)
+    debug_decl(sudo_sigaction, SUDO_DEBUG_MAIN);
 
     for (ss = saved_signals; ss->signo > 0; ss++) {
 	if (ss->signo == signo) {
diff --git a/src/solaris.c b/src/solaris.c
index bc6f063b7..d5ec8d07d 100644
--- a/src/solaris.c
+++ b/src/solaris.c
@@ -66,7 +66,7 @@ set_project(struct passwd *pw)
     struct project proj;
     char buf[PROJECT_BUFSZ];
     int errval;
-    debug_decl(set_project, SUDO_DEBUG_UTIL)
+    debug_decl(set_project, SUDO_DEBUG_UTIL);
 
     /*
      * Collect the default project for the user and settaskid
diff --git a/src/sudo.c b/src/sudo.c
index cd666b46f..40f3b278d 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -142,7 +142,7 @@ main(int argc, char *argv[], char *envp[])
     struct sudo_settings *settings;
     struct plugin_container *plugin, *next;
     sigset_t mask;
-    debug_decl_vars(main, SUDO_DEBUG_MAIN)
+    debug_decl_vars(main, SUDO_DEBUG_MAIN);
 
     initprogname(argc > 0 ? argv[0] : "sudo");
 
@@ -355,7 +355,7 @@ static void
 fix_fds(void)
 {
     int miss[3], devnull = -1;
-    debug_decl(fix_fds, SUDO_DEBUG_UTIL)
+    debug_decl(fix_fds, SUDO_DEBUG_UTIL);
 
     /*
      * stdin, stdout and stderr must be open; set them to /dev/null
@@ -389,7 +389,7 @@ static int
 fill_group_list(struct user_details *ud)
 {
     int ret = -1;
-    debug_decl(fill_group_list, SUDO_DEBUG_UTIL)
+    debug_decl(fill_group_list, SUDO_DEBUG_UTIL);
 
     /*
      * If user specified a max number of groups, use it, otherwise let
@@ -427,7 +427,7 @@ get_user_groups(struct user_details *ud)
     char *cp, *gid_list = NULL;
     size_t glsize;
     int i, len, group_source;
-    debug_decl(get_user_groups, SUDO_DEBUG_UTIL)
+    debug_decl(get_user_groups, SUDO_DEBUG_UTIL);
 
     ud->groups = NULL;
     group_source = sudo_conf_group_source();
@@ -496,7 +496,7 @@ get_user_info(struct user_details *ud)
     mode_t mask;
     struct passwd *pw;
     int fd;
-    debug_decl(get_user_info, SUDO_DEBUG_UTIL)
+    debug_decl(get_user_info, SUDO_DEBUG_UTIL);
 
     /*
      * On BSD systems you can set a hint to keep the password and
@@ -642,7 +642,7 @@ command_info_to_details(char * const info[], struct command_details *details)
     id_t id;
     char *cp;
     const char *errstr;
-    debug_decl(command_info_to_details, SUDO_DEBUG_PCOMM)
+    debug_decl(command_info_to_details, SUDO_DEBUG_PCOMM);
 
     memset(details, 0, sizeof(*details));
     details->closefrom = -1;
@@ -861,7 +861,7 @@ sudo_check_suid(const char *sudo)
     char pathbuf[PATH_MAX];
     struct stat sb;
     bool qualified;
-    debug_decl(sudo_check_suid, SUDO_DEBUG_PCOMM)
+    debug_decl(sudo_check_suid, SUDO_DEBUG_PCOMM);
 
     if (geteuid() != ROOT_UID) {
 	/* Search for sudo binary in PATH if not fully qualified. */
@@ -912,7 +912,7 @@ bool
 set_user_groups(struct command_details *details)
 {
     bool ret = false;
-    debug_decl(set_user_groups, SUDO_DEBUG_EXEC)
+    debug_decl(set_user_groups, SUDO_DEBUG_EXEC);
 
     if (!ISSET(details->flags, CD_PRESERVE_GROUPS)) {
 	if (details->ngroups >= 0) {
@@ -951,7 +951,7 @@ run_command(struct command_details *details)
     struct plugin_container *plugin;
     struct command_status cstat;
     int status = W_EXITCODE(1, 0);
-    debug_decl(run_command, SUDO_DEBUG_EXEC)
+    debug_decl(run_command, SUDO_DEBUG_EXEC);
 
     cstat.type = CMD_INVALID;
     cstat.val = 0;
@@ -1006,7 +1006,7 @@ format_plugin_settings(struct plugin_container *plugin,
     struct sudo_settings *setting;
     char **plugin_settings;
     unsigned int i = 0;
-    debug_decl(format_plugin_settings, SUDO_DEBUG_PCOMM)
+    debug_decl(format_plugin_settings, SUDO_DEBUG_PCOMM);
 
     /* Determine sudo_settings array size (including plugin_path and NULL) */
     plugin_settings_size = 2;
@@ -1062,7 +1062,7 @@ policy_open(struct plugin_container *plugin, struct sudo_settings *settings,
 {
     char **plugin_settings;
     int ret;
-    debug_decl(policy_open, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_open, SUDO_DEBUG_PCOMM);
 
     /* Convert struct sudo_settings to plugin_settings[] */
     plugin_settings = format_plugin_settings(plugin, settings);
@@ -1098,7 +1098,7 @@ policy_open(struct plugin_container *plugin, struct sudo_settings *settings,
 static void
 policy_close(struct plugin_container *plugin, int exit_status, int error_code)
 {
-    debug_decl(policy_close, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_close, SUDO_DEBUG_PCOMM);
     if (plugin->u.policy->close != NULL) {
 	sudo_debug_set_active_instance(plugin->debug_instance);
 	plugin->u.policy->close(exit_status, error_code);
@@ -1114,7 +1114,7 @@ static int
 policy_show_version(struct plugin_container *plugin, int verbose)
 {
     int ret;
-    debug_decl(policy_show_version, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_show_version, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.policy->show_version == NULL)
 	debug_return_int(true);
@@ -1134,7 +1134,7 @@ policy_check(struct plugin_container *plugin, int argc, char * const argv[],
     char **user_env_out[])
 {
     int ret;
-    debug_decl(policy_check, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_check, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.policy->check_policy == NULL) {
 	sudo_fatalx(U_("policy plugin %s is missing the `check_policy' method"),
@@ -1159,7 +1159,7 @@ policy_list(struct plugin_container *plugin, int argc, char * const argv[],
     int verbose, const char *list_user)
 {
     int ret;
-    debug_decl(policy_list, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_list, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.policy->list == NULL) {
 	sudo_warnx(U_("policy plugin %s does not support listing privileges"),
@@ -1180,7 +1180,7 @@ static int
 policy_validate(struct plugin_container *plugin)
 {
     int ret;
-    debug_decl(policy_validate, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_validate, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.policy->validate == NULL) {
 	sudo_warnx(U_("policy plugin %s does not support the -v option"),
@@ -1200,7 +1200,7 @@ policy_validate(struct plugin_container *plugin)
 static void
 policy_invalidate(struct plugin_container *plugin, int remove)
 {
-    debug_decl(policy_invalidate, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_invalidate, SUDO_DEBUG_PCOMM);
     if (plugin->u.policy->invalidate == NULL) {
 	sudo_fatalx(U_("policy plugin %s does not support the -k/-K options"),
 	    plugin->name);
@@ -1219,7 +1219,7 @@ int
 policy_init_session(struct command_details *details)
 {
     int ret = true;
-    debug_decl(policy_init_session, SUDO_DEBUG_PCOMM)
+    debug_decl(policy_init_session, SUDO_DEBUG_PCOMM);
 
     /*
      * We set groups, including supplementary group vector,
@@ -1263,7 +1263,7 @@ iolog_open(struct plugin_container *plugin, struct sudo_settings *settings,
 {
     char **plugin_settings;
     int ret;
-    debug_decl(iolog_open, SUDO_DEBUG_PCOMM)
+    debug_decl(iolog_open, SUDO_DEBUG_PCOMM);
 
     /* Convert struct sudo_settings to plugin_settings[] */
     plugin_settings = format_plugin_settings(plugin, settings);
@@ -1303,7 +1303,7 @@ iolog_open(struct plugin_container *plugin, struct sudo_settings *settings,
 static void
 iolog_close(struct plugin_container *plugin, int exit_status, int error_code)
 {
-    debug_decl(iolog_close, SUDO_DEBUG_PCOMM)
+    debug_decl(iolog_close, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.io->close != NULL) {
 	sudo_debug_set_active_instance(plugin->debug_instance);
@@ -1317,7 +1317,7 @@ static int
 iolog_show_version(struct plugin_container *plugin, int verbose)
 {
     int ret;
-    debug_decl(iolog_show_version, SUDO_DEBUG_PCOMM)
+    debug_decl(iolog_show_version, SUDO_DEBUG_PCOMM);
 
     if (plugin->u.io->show_version == NULL)
 	debug_return_int(true);
@@ -1339,7 +1339,7 @@ iolog_show_version(struct plugin_container *plugin, int verbose)
 static void
 iolog_unlink(struct plugin_container *plugin)
 {
-    debug_decl(iolog_unlink, SUDO_DEBUG_PCOMM)
+    debug_decl(iolog_unlink, SUDO_DEBUG_PCOMM);
 
     /* Deregister hooks, if any. */
     if (plugin->u.io->version >= SUDO_API_MKVERSION(1, 2)) {
@@ -1365,7 +1365,7 @@ plugin_event_set(struct sudo_plugin_event *pev, int fd, int events,
     sudo_ev_callback_t callback, void *closure)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_set, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_set, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     if (sudo_ev_set(&ev_int->private, fd, events, callback, closure) == -1)
@@ -1384,7 +1384,7 @@ static int
 plugin_event_add(struct sudo_plugin_event *pev, struct timespec *timo)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_add, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_add, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     if (sudo_ev_add(NULL, &ev_int->private, timo, 0) == -1)
@@ -1399,7 +1399,7 @@ static int
 plugin_event_del(struct sudo_plugin_event *pev)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_del, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_del, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     if (sudo_ev_del(NULL, &ev_int->private) == -1)
@@ -1415,7 +1415,7 @@ plugin_event_pending(struct sudo_plugin_event *pev, int events,
     struct timespec *ts)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_pending, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_pending, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     debug_return_int(sudo_ev_pending(&ev_int->private, events, ts));
@@ -1428,7 +1428,7 @@ static int
 plugin_event_fd(struct sudo_plugin_event *pev)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_fd, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_fd, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     debug_return_int(sudo_ev_get_fd(&ev_int->private));
@@ -1441,7 +1441,7 @@ static void
 plugin_event_loopbreak(struct sudo_plugin_event *pev)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_loopbreak, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_loopbreak, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     sudo_ev_loopbreak(ev_int->private.base);
@@ -1456,7 +1456,7 @@ static void
 plugin_event_setbase(struct sudo_plugin_event *pev, void *base)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_setbase, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_setbase, SUDO_DEBUG_PCOMM);
 
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
     if (ev_int->private.base != NULL)
@@ -1472,7 +1472,7 @@ static void
 plugin_event_free(struct sudo_plugin_event *pev)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_free, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_free, SUDO_DEBUG_PCOMM);
 
     /* The private field is first so sudo_ev_free() can free the struct. */
     ev_int = __containerof(pev, struct sudo_plugin_event_int, public);
@@ -1488,7 +1488,7 @@ struct sudo_plugin_event *
 sudo_plugin_event_alloc(void)
 {
     struct sudo_plugin_event_int *ev_int;
-    debug_decl(plugin_event_alloc, SUDO_DEBUG_PCOMM)
+    debug_decl(plugin_event_alloc, SUDO_DEBUG_PCOMM);
 
     if ((ev_int = malloc(sizeof(*ev_int))) == NULL)
 	debug_return_ptr(NULL);
@@ -1512,7 +1512,7 @@ sudo_plugin_event_alloc(void)
 static void
 free_plugin_container(struct plugin_container *plugin, bool ioplugin)
 {
-    debug_decl(free_plugin_container, SUDO_DEBUG_PLUGIN)
+    debug_decl(free_plugin_container, SUDO_DEBUG_PLUGIN);
 
     free(plugin->path);
     free(plugin->name);
@@ -1533,7 +1533,7 @@ gc_add(enum sudo_gc_types type, void *v)
 {
 #ifdef NO_LEAKS
     struct sudo_gc_entry *gc;
-    debug_decl(gc_add, SUDO_DEBUG_MAIN)
+    debug_decl(gc_add, SUDO_DEBUG_MAIN);
 
     if (v == NULL)
 	debug_return_bool(false);
@@ -1570,7 +1570,7 @@ gc_run(void)
     struct plugin_container *plugin;
     struct sudo_gc_entry *gc;
     char **cur;
-    debug_decl(gc_run, SUDO_DEBUG_MAIN)
+    debug_decl(gc_run, SUDO_DEBUG_MAIN);
 
     /* Collect garbage. */
     while ((gc = SLIST_FIRST(&sudo_gc_list))) {
diff --git a/src/sudo_edit.c b/src/sudo_edit.c
index b5f00f243..6f15721d8 100644
--- a/src/sudo_edit.c
+++ b/src/sudo_edit.c
@@ -66,7 +66,7 @@ static void
 switch_user(uid_t euid, gid_t egid, int ngroups, GETGROUPS_T *groups)
 {
     int serrno = errno;
-    debug_decl(switch_user, SUDO_DEBUG_EDIT)
+    debug_decl(switch_user, SUDO_DEBUG_EDIT);
 
     sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
 	"set uid:gid to %u:%u(%u)", (unsigned int)euid, (unsigned int)egid,
@@ -99,7 +99,7 @@ switch_user(uid_t euid, gid_t egid, int ngroups, GETGROUPS_T *groups)
 static int
 dir_is_writable(int dfd, struct user_details *ud, struct command_details *cd)
 {
-    debug_decl(dir_is_writable, SUDO_DEBUG_EDIT)
+    debug_decl(dir_is_writable, SUDO_DEBUG_EDIT);
     int rc;
 
     /* Change uid/gid/groups to invoking user, usually needs root perms. */
@@ -130,7 +130,7 @@ static bool
 group_matches(gid_t target, gid_t gid, int ngroups, GETGROUPS_T *groups)
 {
     int i;
-    debug_decl(group_matches, SUDO_DEBUG_EDIT)
+    debug_decl(group_matches, SUDO_DEBUG_EDIT);
 
     if (target == gid) {
 	sudo_debug_printf(SUDO_DEBUG_INFO|SUDO_DEBUG_LINENO,
@@ -156,7 +156,7 @@ static int
 dir_is_writable(int dfd, struct user_details *ud, struct command_details *cd)
 {
     struct stat sb;
-    debug_decl(dir_is_writable, SUDO_DEBUG_EDIT)
+    debug_decl(dir_is_writable, SUDO_DEBUG_EDIT);
 
     if (fstat(dfd, &sb) == -1)
 	debug_return_int(-1);
@@ -208,7 +208,7 @@ set_tmpdir(struct command_details *command_details)
     unsigned int i;
     size_t len;
     int dfd;
-    debug_decl(set_tmpdir, SUDO_DEBUG_EDIT)
+    debug_decl(set_tmpdir, SUDO_DEBUG_EDIT);
 
     for (i = 0; tdir == NULL && i < nitems(tmpdirs); i++) {
 	if ((dfd = open(tmpdirs[i], O_RDONLY)) != -1) {
@@ -241,7 +241,7 @@ sudo_edit_mktemp(const char *ofile, char **tfile)
 {
     const char *cp, *suff;
     int len, tfd;
-    debug_decl(sudo_edit_mktemp, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_mktemp, SUDO_DEBUG_EDIT);
 
     if ((cp = strrchr(ofile, '/')) != NULL)
 	cp++;
@@ -266,7 +266,7 @@ sudo_edit_mktemp(const char *ofile, char **tfile)
 static int
 sudo_edit_openat_nofollow(int dfd, char *path, int oflags, mode_t mode)
 {
-    debug_decl(sudo_edit_openat_nofollow, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_openat_nofollow, SUDO_DEBUG_EDIT);
 
     debug_return_int(openat(dfd, path, oflags|O_NOFOLLOW, mode));
 }
@@ -279,7 +279,7 @@ static bool
 sudo_edit_is_symlink(int fd, char *path)
 {
     struct stat sb1, sb2;
-    debug_decl(sudo_edit_is_symlink, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_is_symlink, SUDO_DEBUG_EDIT);
 
     /*
      * Treat [fl]stat() failure like there was a symlink.
@@ -304,7 +304,7 @@ sudo_edit_openat_nofollow(int dfd, char *path, int oflags, mode_t mode)
 {
     int fd = -1, odfd = -1;
     struct stat sb;
-    debug_decl(sudo_edit_openat_nofollow, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_openat_nofollow, SUDO_DEBUG_EDIT);
 
     /* Save cwd and chdir to dfd */
     if ((odfd = open(".", O_RDONLY)) == -1)
@@ -379,7 +379,7 @@ sudo_edit_open_nonwritable(char *path, int oflags, mode_t mode,
 {
     const int dflags = DIR_OPEN_FLAGS;
     int dfd, fd, is_writable;
-    debug_decl(sudo_edit_open_nonwritable, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_open_nonwritable, SUDO_DEBUG_EDIT);
 
     if (path[0] == '/') {
 	dfd = open("/", dflags);
@@ -447,7 +447,7 @@ sudo_edit_open(char *path, int oflags, mode_t mode,
 {
     const int sflags = command_details ? command_details->flags : 0;
     int fd;
-    debug_decl(sudo_edit_open, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_open, SUDO_DEBUG_EDIT);
 
     if (!ISSET(sflags, CD_SUDOEDIT_FOLLOW))
 	oflags |= O_NOFOLLOW;
@@ -469,7 +469,7 @@ sudo_edit_open(char *path, int oflags, mode_t mode,
     const int sflags = command_details ? command_details->flags : 0;
     struct stat sb;
     int fd;
-    debug_decl(sudo_edit_open, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_open, SUDO_DEBUG_EDIT);
 
     /*
      * Check if path is a symlink.  This is racey but we detect whether
@@ -524,7 +524,7 @@ sudo_edit_create_tfiles(struct command_details *command_details,
     ssize_t nwritten, nread;
     struct timespec times[2];
     struct stat sb;
-    debug_decl(sudo_edit_create_tfiles, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_create_tfiles, SUDO_DEBUG_EDIT);
 
     /*
      * For each file specified by the user, make a temporary version
@@ -652,7 +652,7 @@ sudo_edit_copy_tfiles(struct command_details *command_details,
     struct timespec ts;
     struct stat sb;
     mode_t oldmask;
-    debug_decl(sudo_edit_copy_tfiles, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit_copy_tfiles, SUDO_DEBUG_EDIT);
 
     /* Copy contents of temp files to real ones. */
     for (i = 0; i < nfiles; i++) {
@@ -742,7 +742,7 @@ selinux_edit_create_tfiles(struct command_details *command_details,
     int i, rc, sesh_nargs;
     struct stat sb;
     struct command_details saved_command_details;
-    debug_decl(selinux_edit_create_tfiles, SUDO_DEBUG_EDIT)
+    debug_decl(selinux_edit_create_tfiles, SUDO_DEBUG_EDIT);
     
     /* Prepare selinux stuff (setexeccon) */
     if (selinux_setup(command_details->selinux_role,
@@ -839,7 +839,7 @@ selinux_edit_copy_tfiles(struct command_details *command_details,
     struct command_details saved_command_details;
     struct timespec ts;
     struct stat sb;
-    debug_decl(selinux_edit_copy_tfiles, SUDO_DEBUG_EDIT)
+    debug_decl(selinux_edit_copy_tfiles, SUDO_DEBUG_EDIT);
     
     /* Prepare selinux stuff (setexeccon) */
     if (selinux_setup(command_details->selinux_role,
@@ -935,7 +935,7 @@ sudo_edit(struct command_details *command_details)
     int editor_argc = 0, nfiles = 0;
     struct timespec times[2];
     struct tempfile *tf = NULL;
-    debug_decl(sudo_edit, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit, SUDO_DEBUG_EDIT);
 
     if (!set_tmpdir(command_details))
 	goto cleanup;
@@ -1068,7 +1068,7 @@ cleanup:
 int
 sudo_edit(struct command_details *command_details)
 {
-    debug_decl(sudo_edit, SUDO_DEBUG_EDIT)
+    debug_decl(sudo_edit, SUDO_DEBUG_EDIT);
     debug_return_int(W_EXITCODE(1, 0));
 }
 
diff --git a/src/tgetpass.c b/src/tgetpass.c
index f3a30f233..8f400a34c 100644
--- a/src/tgetpass.c
+++ b/src/tgetpass.c
@@ -68,7 +68,7 @@ static int
 suspend(int signo, struct sudo_conv_callback *callback)
 {
     int ret = 0;
-    debug_decl(suspend, SUDO_DEBUG_CONV)
+    debug_decl(suspend, SUDO_DEBUG_CONV);
 
     if (callback != NULL && SUDO_API_VERSION_GET_MAJOR(callback->version) != SUDO_CONV_CALLBACK_VERSION_MAJOR) {
 	sudo_debug_printf(SUDO_DEBUG_WARN|SUDO_DEBUG_LINENO,
@@ -93,7 +93,7 @@ suspend(int signo, struct sudo_conv_callback *callback)
 static void
 tgetpass_display_error(enum tgetpass_errval errval)
 {
-    debug_decl(tgetpass_display_error, SUDO_DEBUG_CONV)
+    debug_decl(tgetpass_display_error, SUDO_DEBUG_CONV);
 
     switch (errval) {
     case TGP_ERRVAL_NOERROR:
@@ -126,7 +126,7 @@ tgetpass(const char *prompt, int timeout, int flags,
     int i, input, output, save_errno, ttyfd;
     bool need_restart, neednl = false;
     enum tgetpass_errval errval;
-    debug_decl(tgetpass, SUDO_DEBUG_CONV)
+    debug_decl(tgetpass, SUDO_DEBUG_CONV);
 
     (void) fflush(stdout);
 
@@ -294,7 +294,7 @@ sudo_askpass(const char *askpass, const char *prompt)
     enum tgetpass_errval errval;
     int pfd[2], status;
     pid_t child;
-    debug_decl(sudo_askpass, SUDO_DEBUG_CONV)
+    debug_decl(sudo_askpass, SUDO_DEBUG_CONV);
 
     /* Set SIGCHLD handler to default since we call waitpid() below. */
     memset(&sa, 0, sizeof(sa));
@@ -373,7 +373,7 @@ getln(int fd, char *buf, size_t bufsiz, int feedback,
     ssize_t nr = -1;
     char *cp = buf;
     char c = '\0';
-    debug_decl(getln, SUDO_DEBUG_CONV)
+    debug_decl(getln, SUDO_DEBUG_CONV);
 
     *errval = TGP_ERRVAL_NOERROR;
 
diff --git a/src/ttyname.c b/src/ttyname.c
index 69788dd9f..3ec25361f 100644
--- a/src/ttyname.c
+++ b/src/ttyname.c
@@ -104,7 +104,7 @@ get_process_ttyname(char *name, size_t namelen)
     size_t size = sizeof(*ki_proc);
     int mib[6], rc, serrno = errno;
     char *ret = NULL;
-    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL)
+    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL);
 
     /*
      * Lookup controlling tty for this process via sysctl.
@@ -158,7 +158,7 @@ get_process_ttyname(char *name, size_t namelen)
     struct psinfo psinfo;
     ssize_t nread;
     int fd, serrno = errno;
-    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL)
+    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL);
 
     /* Try to determine the tty from pr_ttydev in /proc/pid/psinfo. */
     (void)snprintf(path, sizeof(path), "/proc/%u/psinfo", (unsigned int)getpid());
@@ -201,7 +201,7 @@ get_process_ttyname(char *name, size_t namelen)
     int serrno = errno;
     ssize_t nread;
     int fd;
-    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL)
+    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL);
 
     /*
      * Try to determine the tty from tty_nr in /proc/self/stat.
@@ -284,7 +284,7 @@ get_process_ttyname(char *name, size_t namelen)
     struct pst_status pstat;
     char *ret = NULL;
     int rc, serrno = errno;
-    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL)
+    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL);
 
     /*
      * Determine the tty from psdev in struct pst_status.
@@ -318,7 +318,7 @@ char *
 get_process_ttyname(char *name, size_t namelen)
 {
     char *tty;
-    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL)
+    debug_decl(get_process_ttyname, SUDO_DEBUG_UTIL);
 
     if ((tty = ttyname(STDIN_FILENO)) == NULL) {
 	if ((tty = ttyname(STDOUT_FILENO)) == NULL)
diff --git a/src/utmp.c b/src/utmp.c
index c8341cbed..965e463b8 100644
--- a/src/utmp.c
+++ b/src/utmp.c
@@ -109,7 +109,7 @@ utmp_setid(sudo_utmp_t *old, sudo_utmp_t *new)
 {
     const char *line = new->ut_line;
     size_t idlen;
-    debug_decl(utmp_setid, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_setid, SUDO_DEBUG_UTMP);
 
     /* Skip over "tty" in the id if old entry did too. */
     if (old != NULL) {
@@ -141,7 +141,7 @@ static void
 utmp_settime(sudo_utmp_t *ut)
 {
     struct timeval tv;
-    debug_decl(utmp_settime, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_settime, SUDO_DEBUG_UTMP);
 
     if (gettimeofday(&tv, NULL) == 0) {
 #if defined(HAVE_STRUCT_UTMP_UT_TV)
@@ -162,7 +162,7 @@ static void
 utmp_fill(const char *line, const char *user, sudo_utmp_t *ut_old,
     sudo_utmp_t *ut_new)
 {
-    debug_decl(utmp_file, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_file, SUDO_DEBUG_UTMP);
 
     if (ut_old == NULL) {
 	memset(ut_new, 0, sizeof(*ut_new));
@@ -204,7 +204,7 @@ utmp_login(const char *from_line, const char *to_line, int ttyfd,
 {
     sudo_utmp_t utbuf, *ut_old = NULL;
     bool ret = false;
-    debug_decl(utmp_login, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_login, SUDO_DEBUG_UTMP);
 
     /* Strip off /dev/ prefix from line as needed. */
     if (strncmp(to_line, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
@@ -232,7 +232,7 @@ utmp_logout(const char *line, int status)
 {
     bool ret = false;
     sudo_utmp_t *ut, utbuf;
-    debug_decl(utmp_logout, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_logout, SUDO_DEBUG_UTMP);
 
     /* Strip off /dev/ prefix from line as needed. */
     if (strncmp(line, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
@@ -269,7 +269,7 @@ utmp_slot(const char *line, int ttyfd)
 {
     int slot = 1;
     struct ttyent *tty;
-    debug_decl(utmp_slot, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_slot, SUDO_DEBUG_UTMP);
 
     setttyent();
     while ((tty = getttyent()) != NULL) {
@@ -285,7 +285,7 @@ static int
 utmp_slot(const char *line, int ttyfd)
 {
     int sfd, slot;
-    debug_decl(utmp_slot, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_slot, SUDO_DEBUG_UTMP);
 
     /*
      * Temporarily point stdin to the tty since ttyslot()
@@ -312,7 +312,7 @@ utmp_login(const char *from_line, const char *to_line, int ttyfd,
     bool ret = false;
     int slot;
     FILE *fp;
-    debug_decl(utmp_login, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_login, SUDO_DEBUG_UTMP);
 
     /* Strip off /dev/ prefix from line as needed. */
     if (strncmp(to_line, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0)
@@ -364,7 +364,7 @@ utmp_logout(const char *line, int status)
     sudo_utmp_t utbuf;
     bool ret = false;
     FILE *fp;
-    debug_decl(utmp_logout, SUDO_DEBUG_UTMP)
+    debug_decl(utmp_logout, SUDO_DEBUG_UTMP);
 
     if ((fp = fopen(_PATH_UTMP, "r+")) == NULL)
 	debug_return_int(ret);